Live › vulnerability › CVE-2026-56386
Go to dashboardA zero-length HTTP/2 DATA frame with the PADDED flag makes the bRPC HTTP/2 parser underflow a size counter and read past the buffer. An unauthenticated remote client can crash the server, a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only servers built on Apache bRPC that accept HTTP/2 traffic, either cleartext h2c on an HTTP port or TLS with ALPN, are exposed. A remote client that can reach the port can trigger it without credentials. Services that do not serve HTTP/2 through bRPC can skip it.
No product ranges from the sources yet.
grep -ri brpc in the project's dependency lock files or build config to find the bRPC version in use1.18.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-length payload.
Root Cause: The HTTP/2 DATA frame handler computed the fragment size from the attacker-controlled payload length and, when the PADDED flag was present, decremented the fragment size before ensuring that the frame contained the mandatory pad length byte. A zero-length padded DATA frame could therefore underflow the unsigned fragment size and read the pad length byte past the end of the frame buffer.
Affected Scenarios: Apache bRPC servers that accept HTTP/2 traffic are affected when a remote client can send crafted HTTP/2 frames to the server. HTTP/2 may be reached through cleartext h2c detection on an HTTP port or through TLS ALPN negotiation.
How to Fix: (Choose one of the following options)
Note: The fix validates that a padded DATA frame has enough payload bytes for the pad length field before decrementing the fragment size or reading the pad length byte. Malformed zero-length padded DATA frames are rejected with HTTP/2 FRAME_SIZE_ERROR.
This page as .md · .json · in your agent: get_signal("CVE-2026-56386")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.