CVE-2026-56386 in bRPC
Summary
by MITRE • 10/22/2026
Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-length payload.
Root Cause: The HTTP/2 DATA frame handler computed the fragment size from the attacker-controlled payload length and, when the PADDED flag was present, decremented the fragment size before ensuring that the frame contained the mandatory pad length byte. A zero-length padded DATA frame could therefore underflow the unsigned fragment size and read the pad length byte past the end of the frame buffer.
Affected Scenarios: Apache bRPC servers that accept HTTP/2 traffic are affected when a remote client can send crafted HTTP/2 frames to the server. HTTP/2 may be reached through cleartext h2c detection on an HTTP port or through TLS ALPN negotiation.
How to Fix: (Choose one of the following options) 1. Upgrade Apache bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3325
Note: The fix validates that a padded DATA frame has enough payload bytes for the pad length field before decrementing the fragment size or reading the pad length byte. Malformed zero-length padded DATA frames are rejected with HTTP/2 FRAME_SIZE_ERROR.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified in Apache bRPC involves critical flaws within its HTTP/2 server implementation, specifically affecting the parsing of DATA frames when the PADDED flag is utilized. This issue manifests as both an integer underflow and a subsequent out-of-bounds read condition. The root cause lies in the sequence of operations performed by the frame handler during payload processing. When handling a padded DATA frame, the system calculates the fragment size based on the attacker-controlled payload length field found within the HTTP/2 header. Crucially, the implementation decrements this calculated fragment size to account for the mandatory pad length byte before verifying that sufficient data actually exists in the buffer to contain it. In scenarios where an unauthenticated remote attacker sends a malformed DATA frame with the PADDED flag set but a zero-length payload, this logic fails catastrophically. Because the initial calculation assumes space for padding and then subtracts one without first confirming the presence of that byte, the unsigned integer representing the fragment size underflows to a very large positive value. This erroneous value subsequently allows the parser to read memory beyond the bounds of the allocated frame buffer when attempting to retrieve the pad length byte.
The operational impact of this vulnerability is primarily centered on denial of service conditions for Apache bRPC servers that accept HTTP/2 traffic. An attacker can exploit this flaw by sending crafted HTTP/2 frames over either cleartext connections via h2c detection or through TLS encrypted channels using ALPN negotiation. The out-of-bounds read may lead to the exposure of sensitive internal memory contents, potentially leaking stack data, heap metadata, or other confidential information depending on what resides in the adjacent memory regions at the time of exploitation. Furthermore, if the subsequent processing logic relies on this corrupted state, it can trigger crashes or undefined behavior within the server process, effectively rendering the service unavailable to legitimate users. This aligns with CWE-190 for integer underflow and CWE-787 for out-of-bounds read vulnerabilities, representing a classic class of memory safety errors often found in systems programming languages like C++ where manual memory management is required.
From an offensive security perspective, this vulnerability maps to the MITRE ATT&CK technique T1499 Endpoint Denial of Service, as it allows remote actors to disrupt service availability without authentication. It also touches upon information disclosure vectors if the out-of-bounds read successfully leaks data that can be exfiltrated by the attacker through side-channel analysis or subsequent requests leveraging the corrupted state. The vulnerability highlights a common pitfall in protocol parsing where validation of structural integrity is not performed prior to arithmetic operations on length fields. This specific flaw underscores the importance of validating frame boundaries and payload sizes before performing any modifications to counters that dictate memory access patterns.
To mitigate this risk, organizations running Apache bRPC must take immediate action by upgrading to version 1.18.0 or later, which incorporates a corrected implementation of the DATA frame parser. Alternatively, administrators can apply the specific patch available via pull request 3325 on the official Apache GitHub repository. The fix addresses the root cause by enforcing strict validation that ensures a padded DATA frame contains sufficient payload bytes to accommodate the pad length field before any decrement operations are performed or memory is accessed for reading the pad byte. If such validation fails, specifically in cases of malformed zero-length padded frames, the server now correctly rejects the connection with an HTTP/2 FRAME_SIZE_ERROR code rather than proceeding into unsafe memory access patterns. This ensures that only well-formed frames are processed, thereby eliminating both the underflow condition and the associated out-of-bounds read vulnerability.