{"id":"CVE-2026-56386","kind":"vulnerability","aliases":["CVE-2026-56386"],"related":[],"title":"Apache bRPC: malformed HTTP/2 DATA frame crashes servers remotely","description":"Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-length payload.\n\nRoot Cause:\nThe HTTP/2 DATA frame handler computed the fragment size from the attacker-controlled payload length and, when the PADDED flag was present, decremented the fragment size before ensuring that the frame contained the mandatory pad length byte. A zero-length padded DATA frame could therefore underflow the unsigned fragment size and read the pad length byte past the end of the frame buffer.\n\nAffected Scenarios:\nApache bRPC servers that accept HTTP/2 traffic are affected when a remote client can send crafted HTTP/2 frames to the server. HTTP/2 may be reached through cleartext h2c detection on an HTTP port or through TLS ALPN negotiation.\n\nHow to Fix:\n(Choose one of the following options)\n1. Upgrade Apache bRPC to version 1.18.0, which fixes this issue.\n2. Apply this patch:  https://github.com/apache/brpc/pull/3325 \n\nNote:\nThe fix validates that a padded DATA frame has enough payload bytes for the pad length field before decrementing the fragment size or reading the pad length byte. Malformed zero-length padded DATA frames are rejected with HTTP/2 FRAME_SIZE_ERROR.","summary":"A zero-length HTTP/2 DATA frame with the PADDED flag makes the bRPC HTTP/2 parser underflow a size counter and read past the buffer. An unauthenticated remote client can crash the server, a denial of service.","severity":"high","cvss":7.5,"epss":0.00732,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-brpc","c++","http2","package","rpc-servers"],"not_affected_if":["no-http2-listener","not-internet-reachable"],"how_to_check":"- Run `grep -ri brpc` in the project's dependency lock files or build config to find the bRPC version in use\n- Check whether the bRPC server listens on an HTTP port that accepts HTTP/2 (h2c or TLS ALPN)","fix":"- Upgrade Apache bRPC to `1.18.0`\n- Or apply the patch from https://github.com/apache/brpc/pull/3325","status":"open","published_at":"2026-10-21T12:17:21+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:16:55+00:00","updated_at":"2026-10-25T03:16:55+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:16:55Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache bRPC to `1.18.0`\n- Or apply the patch from https://github.com/apache/brpc/pull/3325","reach":"internet","title":"Apache bRPC: malformed HTTP/2 DATA frame crashes servers remotely","impact":"low","summary":"A zero-length HTTP/2 DATA frame with the PADDED flag makes the bRPC HTTP/2 parser underflow a size counter and read past the buffer. An unauthenticated remote client can crash the server, a denial of service.","category":"package","nicknames":[],"who_cares":["apache-brpc","c++","rpc-servers","http2"],"confidence":0.7,"needs_auth":"no","worst_case":"Remote unauthenticated attacker crashes the bRPC server process (denial of service)","analyst_note":"","how_to_check":"- Run `grep -ri brpc` in the project's dependency lock files or build config to find the bRPC version in use\n- Check whether the bRPC server listens on an HTTP port that accepts HTTP/2 (h2c or TLS ALPN)","needs_analyst":false,"not_affected_if":["no-http2-listener","not-internet-reachable"],"who_is_affected":"Only servers built on Apache bRPC that accept HTTP/2 traffic, either cleartext h2c on an HTTP port or TLS with ALPN, are exposed. A remote client that can reach the port can trigger it without credentials. Services that do not serve HTTP/2 through bRPC can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000657,"input_tokens":3762,"output_tokens":562,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-56386':12A,15A '/apache/brpc/pull/3325':240C '1':223C '1.18.0':229C '2':234C 'accept':180C 'affect':174C,184C 'allow':80C 'alpn':212C 'apach':1A,17B,78C,176C,225C 'apache-brpc':16B 'appli':235C 'attack':84C,121C 'attacker-control':120C 'bound':68C 'brpc':2A,18B,38B,79C,177C,226C 'buffer':49B,173C 'byte':146C,166C,253C,269C 'c':19B 'caus':86C,108C 'choos':217C 'cleartext':202C 'client':53B,188C 'comput':114C 'contain':141C 'control':122C 'could':154C 'counter':44B 'craft':191C 'crash':7A,55B 'cve':10A,13A 'data':5A,30B,74C,94C,111C,152C,248C,275C 'decrement':132C,260C 'denial':59B,87C 'detect':204C 'end':169C 'enough':251C 'ensur':137C 'error':283C 'field':258C 'fix':216C,231C,243C 'flag':35B,99C,129C 'follow':221C 'fragment':116C,134C,159C,262C 'frame':6A,31B,75C,95C,112C,140C,153C,172C,193C,249C,276C,281C 'github.com':239C 'github.com/apache/brpc/pull/3325':238C 'h2c':203C 'handler':113C 'http':207C 'http/2':4A,29B,39B,72C,110C,181C,192C,197C,280C 'http2':20B 'integ':62C 'issu':233C 'length':28B,105C,124C,145C,150C,165C,257C,268C,273C 'make':36B 'malform':3A,93C,270C 'mandatori':143C 'may':198C 'negoti':213C 'note':241C 'one':218C 'option':222C 'out-of-bound':65C 'packag':21B 'pad':34B,98C,128C,144C,151C,164C,247C,256C,267C,274C 'parser':40B,76C 'past':47B,167C 'patch':237C 'payload':106C,123C,252C 'port':208C 'present':131C 'reach':200C 'read':46B,69C,162C,265C 'reject':278C 'remot':9A,52B,83C,187C 'root':107C 'rpc':23B 'rpc-server':22B 'scenario':175C 'send':91C,190C 'server':8A,24B,57B,73C,178C,196C 'servic':61B,89C 'set':100C 'size':43B,117C,135C,160C,263C,282C 'therefor':155C 'tls':211C 'traffic':182C 'unauthent':51B,82C 'underflow':41B,63C,156C 'unsign':158C 'upgrad':224C 'valid':244C 'version':228C 'zero':27B,104C,149C,272C 'zero-length':26B,103C,148C,271C","nicknames":[],"mitigations":[],"who_affected":"Only servers built on Apache bRPC that accept HTTP/2 traffic, either cleartext h2c on an HTTP port or TLS with ALPN, are exposed. A remote client that can reach the port can trigger it without credentials. Services that do not serve HTTP/2 through bRPC can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T12:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-56386","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56386","severity":null,"published_at":"2026-10-21T12:17:21+00:00","modified_at":"2026-10-22T16:56:37+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-56386","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-56386","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}