EUVD-2026-107172
GHSA-wj5x-6jj2-m348
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach HTTP/2 endpoint (h2c or ALPN)
-
ExploitSend zero-length PADDED DATA frame
-
ExecutionUnderflow unsigned fragment size, read past buffer
-
ImpactCrash/disrupt bRPC server (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer underflow checks
|
| Exploitation Conditions | The target bRPC server must be built/configured to accept HTTP/2 traffic, reachable either through cleartext h2c detection on an HTTP port or through TLS ALPN negotiation - if the server does not expose an HTTP/2-capable listener, it is not exploitable. Given that prerequisite, exploitation is unauthenticated and requires no user interaction: the attacker only needs network reachability to the HTTP/2 port and the ability to send a single crafted DATA frame with the PADDED flag and a zero-length payload. The primary limiting factor is whether HTTP/2 is enabled/negotiable on the exposed service; affected versions are those prior to Apache bRPC 1.18.0. |
| Impact | No CVSS score or vector was provided in the input (CVSS: N/A), so attack-vector and privilege metrics must be inferred from the description rather than confirmed. The description explicitly states 'unauthenticated remote attacker,' which aligns with a network attack vector requiring no privileges and no user interaction; my independent assessment yields CVSS:3.1 7.5 (AV:N/AC:L/PR:N/UI:N/A:H). Crucially, the impact is limited to denial of service via an out-of-bounds read - there is no code execution and no confidentiality/integrity impact - so despite the 'Buffer Overflow' and 'Integer Overflow' tags, this is NOT a memory-corruption RCE. No EPSS score, no CISA KEV listing, and no public POC are present in the data, so there is no evidence of active exploitation: this is 'no public exploit identified at time of analysis.' The low complexity and unauthenticated network reachability make weaponization for availability attacks straightforward if HTTP/2 is exposed, but the DoS-only ceiling and the niche deployment footprint of bRPC keep real-world priority moderate rather than critical. Prioritize patching on internet-facing bRPC servers that accept HTTP/2; internal-only services are lower urgency. |
| Exploit ScenarioDerived | An attacker who can reach an Apache bRPC server speaking HTTP/2 (via h2c cleartext detection on an HTTP port or via TLS ALPN negotiation) sends a single malformed DATA frame that sets the PADDED flag but carries a zero-length payload. The parser decrements the unsigned fragment size before confirming a pad-length byte exists, underflowing the size and reading past the frame buffer, crashing or disrupting the service. No authentication, user interaction, or public exploit code is required, though no POC is currently known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Denial of service in Apache bRPC servers that accept HTTP/2 traffic is caused by a malformed DATA frame with the PADDED flag set and a zero-length payload. An unauthenticated remote attacker with network reachability to an h2c- or TLS-ALPN-exposed HTTP/2 listener can trigger an integer underflow and out-of-bounds read, leading to high availability impact; versions before 1.18.0 are affected. No public exploit was identified at time of analysis, and the independent assessment rates the issue as network-reachable, low complexity, and requiring no privileges or user interaction.
RemediationAI
Upgrade Apache bRPC to version 1.18.0, which validates that padded DATA frames contain enough payload bytes for the pad-length field before decrementing the fragment size and rejects malformed zero-length padded frames with HTTP/2 FRAME_SIZE_ERROR. If an immediate upgrade is not possible, apply the upstream fix referenced at https://github.com/apache/brpc/pull/3325 or, as a compensating control, disable HTTP/2 on exposed bRPC listeners by turning off h2c detection and removing h2 from TLS ALPN, or restrict network access to trusted HTTP/2 clients only; disabling HTTP/2 will break HTTP/2-dependent clients, and network filtering is only effective when the HTTP/2 listener does not need to be reachable by untrusted users. Vendor guidance is available at https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache bRPC's HTTP/2 server DATA-frame parser handled padded frames incorrectly. The code derived an unsigned fragment size from the attacker-controlled payload length and decremented it for padding before verifying that at least one byte existed for the mandatory pad-length field. With a zero-length payload marked PADDED, the decrement underflows the unsigned size, and the parser reads the pad-length byte beyond the end of the frame buffer (CWE-191 integer underflow leading to an out-of-bounds read). The fix in 1.18.0 adds length validation and rejects malformed padded DATA frames with HTTP/2 FRAME_SIZE_ERROR. This affects bRPC deployments exposing HTTP/2 through cleartext h2c detection on an HTTP port or TLS ALPN negotiation; the input CPE cpe:2.3:a:apache_software_foundation:apache_brpc:*:*:*:*:*:*:*:* is consistent with affected releases before 1.18.0, and the assessment confirms remote unauthenticated availability impact.
Know when Apache Brpc gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated remote attacker sends one crafted frame (AV:N/AC:L/PR:N/UI:N); out-of-bounds read causes service crash so A:H, with no confidentiality or integrity impact.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
3DescriptionCVE.org
Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-length payload.
Root Cause: The HTTP/2 DATA frame handler computed the fragment size from the attacker-controlled payload length and, when the PADDED flag was present, decremented the fragment size before ensuring that the frame contained the mandatory pad length byte. A zero-length padded DATA frame could therefore underflow the unsigned fragment size and read the pad length byte past the end of the frame buffer.
Affected Scenarios: Apache bRPC servers that accept HTTP/2 traffic are affected when a remote client can send crafted HTTP/2 frames to the server. HTTP/2 may be reached through cleartext h2c detection on an HTTP port or through TLS ALPN negotiation.
How to Fix: (Choose one of the following options)
- Upgrade Apache bRPC to version 1.18.0, which fixes this issue.
- Apply this patch: https://github.com/apache/brpc/pull/3325
Note: The fix validates that a padded DATA frame has enough payload bytes for the pad length field before decrementing the fragment size or reading the pad length byte. Malformed zero-length padded DATA frames are rejected with HTTP/2 FRAME_SIZE_ERROR.
Executive ViewAI
Apache bRPC deployments that expose HTTP/2 listeners (h2c or TLS-ALPN) are susceptible to a remotely triggerable denial-of-service condition that can take RPC-dependent services offline; no public exploit was identified at time of analysis. Because bRPC often underpins internal service-to-service communication, a successful attack could cascade into availability failures for customer-facing applications and internal workflows. Leadership should prioritize inventory and network exposure reduction while a vendor fix is pending.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to bRPC HTTP/2 listeners (h2c and TLS-ALPN) to trusted sources only; disable HTTP/2 where not required; deploy rate limiting, connection limits, or a reverse proxy/WAF in front of exposed listeners; segment bRPC services to limit blast radius; monitor for malformed DATA frames and availability degradation; and plan upgrade to bRPC 1.18.0 or later when available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Apache Brpc
View allRemote unauthenticated denial of service affects Apache bRPC versions before 1.18.0 when the optional RTMP service is en
Memory exhaustion in Apache bRPC versions prior to 1.18.0 lets remote attackers force excessive preallocation on servers
A single unauthenticated request can abort an Apache bRPC server (versions before 1.18.0) that has been explicitly confi
TLS endpoint impersonation in Apache bRPC before 1.18.0 allows an on-path attacker who can redirect or intercept a clien
Remote denial of service affects Apache bRPC deployments before 1.18.0 when built on platforms where plain char is unsig
Memory exhaustion denial of service in Apache bRPC before 1.18.0 allows remote unauthenticated peers to push buffered me
Memory and CPU exhaustion in Apache bRPC's Redis-protocol handler lets remote unauthenticated clients inflate server res
Out-of-bounds write in Apache bRPC's Redis RESP parser allows remote unauthenticated attackers who can reach a bRPC serv
Memory exhaustion in Apache bRPC's RTMP AMF parser allows unauthenticated remote attackers to consume excessive resource
Denial of service in Apache bRPC before 1.18.0 allows an unauthenticated remote RTMP peer to crash the bRPC process by s
Remote denial of service in Apache bRPC (versions before 1.18.0) allows a malicious, compromised, or faulty Redis server
Remote unauthenticated denial of service in Apache bRPC before 1.18.0 allows attackers to exhaust the server thread stac
Exploit-DB