Integer Underflow Vulnerability in Apache bRPC's HTTP/2 Server

CVE-2026-56386

What is CVE-2026-56386?

The vulnerability in Apache bRPC's HTTP/2 server arises from an integer underflow and out-of-bounds read during the parsing of DATA frames. This flaw allows an unauthenticated remote attacker to send a crafted DATA frame, which can exploit the PADDED flag and zero-length payload to induce a denial of service. The underlying issue is that the server incorrectly computes fragment sizes without adequately validating the padded DATA frame's length, leading to potential exploitation through carefully manipulated HTTP/2 traffic. Affected servers should upgrade to version 1.18.0 or apply the provided patch to ensure robust handling of padded DATA frames.

References