The vulnerability is an integer underflow and out‑of‑bounds read in the HTTP/2 server DATA frame parser of Apache bRPC. A malformed DATA frame with the PADDED flag set and a zero‑length payload can cause the parser to underflow the unsigned fragment size and read memory past the end of the frame buffer. This leads to a denial of service condition on the affected server; the flaw is exploitable by an unauthenticated remote client and does not require any additional privileges.

Apache Software Foundation’s Apache bRPC services that accept HTTP/2 traffic are impacted. Any instance of Apache bRPC that processes HTTP/2 frames—whether via cleartext h2c detection on a standard HTTP port or via TLS ALPN negotiation—is vulnerable.

The CVSS score is 7.5, and the EPSS score is unavailable, so an exact exploitation probability cannot be quantified. The flaw is not listed in CISA’s KEV catalog. Because the attack requires only an unauthenticated client to send a crafted HTTP/2 frame, the potential for exploitation exists in any exposed bRPC service that enables HTTP/2. No public exploit has been reported, but the absence of a requirement for special configuration or privileged access increases the likelihood that malicious actors could create custom clients to trigger the denial of service.