# Malformed frame reaches assert

Parser or state-machine throws or asserts on attacker-controlled frames, aborting the process or killing a receive loop.

_Area: Network devices and IoT. Seen in 3 disclosed reports; one confirmed bounty: $250; latest 2026-08-12. Updated 2026-10-24._

## How it works
Protocol code assumes frames arriving at a parser or state machine are well-formed enough to reach the next step. When a malformed frame violates that assumption, the code hits an assertion or throws an exception instead of returning a protocol error. If the assert aborts the process, or the throw escapes a receive loop that is never restarted, one bad frame takes down the whole service. The broken assumption is that malformed input is rejected gracefully; in practice it reaches an abort path.

## Where it shows up
- Assertions in native protocol handlers reachable from network input (e.g. HTTP/2 SETTINGS handling in node_http2.cc) [E3](https://bugbountylibrary.com/r/h1%3A800140.md)
- Async receive loops launched fire-and-forget with no restart on exit [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-pfvm-w89x-94jw.md)
- A catch block lexically outside the `while` loop, or per-datagram parsing outside the `try` [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-pfvm-w89x-94jw.md)
- Shared stores with equality assertions fed by multiple ingestion paths, where one path canonicalizes and another passes raw values [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-63wg-wjjj-7cp8.md)
- Parser entry points (STUN, HTTP/2 control frames) called directly on attacker bytes with no guard [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-pfvm-w89x-94jw.md)[E3](https://bugbountylibrary.com/r/h1%3A800140.md)

## How to review
For each network-facing parser and state machine, check the invariant: any malformed frame must produce a protocol error and leave the service running. Concretely: is every per-message parse inside a `try` that is inside the receive loop? Does the loop restart after an exception? Are assertions in native handlers reachable from untrusted input, and do they abort rather than return an error? For shared stores, verify all ingestion paths canonicalize values identically before they reach equality checks [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-63wg-wjjj-7cp8.md).

## Variants seen
- Reachable assert in a native HTTP/2 handler aborts the process on malformed SETTINGS frames [E3](https://bugbountylibrary.com/r/h1%3A800140.md)
- Parser throw escapes a fire-and-forget UDP receive loop, permanently disabling TURN relay [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-pfvm-w89x-94jw.md)
- Non-canonicalized address from one path trips an address-book assertion in a P2P node [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-63wg-wjjj-7cp8.md)

## Impact and severity
All three are denial of service. Severity rises when the crash is pre-auth and remote [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-pfvm-w89x-94jw.md)[E3](https://bugbountylibrary.com/r/h1%3A800140.md), when it affects all clients rather than one connection [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-pfvm-w89x-94jw.md), and when no restart recovers the service [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-pfvm-w89x-94jw.md). A single datagram or frame is enough, making it trivially repeatable.

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-63wg-wjjj-7cp8.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-pfvm-w89x-94jw.md
- E3: https://bugbountylibrary.com/r/h1%3A800140.md