CVE-2026-56386

waiting for further signals

GHSA-wj5x-6jj2-m348 ↗

no check availablenot proven exploitable

cve.orgpublic pockev

Apache Software Foundation Apache bRPC < 1.18.0

fixed in 1.18.0

CWE-191 Integer Underflow (Wrap or Wraparound)

ETK-2026-2315, permanent identifier

1h 28msince last run

29mAI analysis

timeline

0 = cve.org publication

trigger signal (cve.org) +0hwaiting for further signals+0h43m

+2h

+4h

+6h

+8h

+10h

+12h

description

Apache bRPC servers that accept HTTP/2 connections are affected by a parsing flaw in DATA frames. An unauthenticated remote client may cause a denial of service with malformed HTTP/2 traffic when it can reach the server's HTTP/2 endpoint.

mitigation

Upgrade Apache bRPC to version 1.18.0. Until upgraded, restrict untrusted access to HTTP/2 listeners, including h2c and TLS-negotiated HTTP/2 endpoints.

fixed in 1.18.0

check

exploit

automation

–

auth required

–

EPSS

–

agent run time

29m

cve.org record, t = 0

2026-10-21 11:37Z

Δ to public poc

–

Δ to kev

–

outcome

No artifact: an exploit or check was attempted but could not be produced at this moment.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-10-21 11:37Z
cve_org: trigger signal, started the run
https://www.cve.org/CVERecord?id=CVE-2026-56386

this entry in the feed

GET /api/v1/feed/CVE-2026-56386

{
  "etk_id": "ETK-2026-2315",
  "cve_id": "CVE-2026-56386",
  "display_id": "CVE-2026-56386",
  "ghsa_id": "GHSA-wj5x-6jj2-m348",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "anchored",
  "title": "Integer underflow in Apache bRPC HTTP/2 DATA parsing",
  "summary": "Apache bRPC servers that accept HTTP/2 connections are affected by a parsing flaw in DATA frames. An unauthenticated remote client may cause a denial of service with malformed HTTP/2 traffic when it can reach the server's HTTP/2 endpoint.",
  "mitigation": "Upgrade Apache bRPC to version 1.18.0. Until upgraded, restrict untrusted access to HTTP/2 listeners, including h2c and TLS-negotiated HTTP/2 endpoints.",
  "vendor": "Apache Software Foundation",
  "product": "Apache bRPC",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 1.18.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "1.18.0"
      ],
      "package_name": "apache/brpc",
      "purl": null
    }
  ],
  "cwes": [
    191
  ],
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 29.174333833333332,
  "t0_at": "2026-10-21T11:37:47.458000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-21T11:37:47.458000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-21T11:37:47.458000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56386"
    }
  }
}

published 2026-10-21 11:51Z
last change 2026-10-21 13:29Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.