EUVD-2026-107173
GHSA-79v7-r95h-fxr5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach bRPC RTMP listener
-
DeliverySend small crafted AMF payload
-
ExploitDeclare oversized string length or array count
-
ExecutionParser allocates excessive memory
-
ImpactResource exhaustion / service denial
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory allocation limits
|
| Exploitation Conditions | Requires the bRPC RTMP server component to be enabled and accepting RTMP traffic from untrusted clients, or direct use of the AMF parser on untrusted data - RTMP is not enabled by default, which limits exposure to deployments that opt in. Once reachable, no authentication, privileges, or user interaction are needed: a single small AMF message with an oversized declared long-string length or array/ECMA element count triggers the oversized allocation before the incomplete payload is rejected. Post-fix (bRPC 1.18.0), exploitation is additionally limited by the default caps (64 MiB string size, 1,048,576 array elements), tunable via amf_max_string_size and amf_max_array_size. |
| Impact | No CVSS vector is provided in the input (CVSS: N/A), so severity signals must be inferred from the description and CWE-789 (Memory Allocation with Excessive Size Value). The flaw is remotely reachable by an unauthenticated attacker against a bRPC server with the RTMP component enabled, which argues for a network attack vector, low complexity, and no privileges (equivalent to AV:N/AC:L/PR:N/UI:N). However, the impact is confined to availability: a crafted AMF payload triggers oversized memory allocation or resource consumption, a denial-of-service condition - there is no indication of code execution, data disclosure, or integrity loss despite the 'Information Disclosure' tag, which appears mislabeled given CWE-789. No EPSS score, KEV listing, or POC is present in the input, so there is no evidence of active or probable exploitation; this reads as a credible but not high-priority DoS issue rather than a critical widely-exploited flaw. A significant mitigating factor is that the RTMP server component must be explicitly enabled and exposed to untrusted clients, which is not a universal default. Net: moderate risk, elevated only where RTMP is deployed on untrusted networks; prioritize patching for those specific deployments. |
| Exploit ScenarioDerived | An attacker who can reach a bRPC instance with RTMP enabled sends a small AMF message declaring an enormous 32-bit long-string length or array element count. The parser resizes/allocates for the declared size before validating that the bytes are present, causing excessive memory allocation or resource consumption that can degrade or crash the service. No authentication or user interaction is required, but no public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory exhaustion in Apache bRPC's RTMP AMF parser allows unauthenticated remote attackers to consume excessive resources on servers that opt into the RTMP component. Versions before 1.18.0 accept attacker-declared long-string lengths and array element counts without first confirming the payload contains enough bytes, so a small AMF message can force oversized allocations before parsing fails. RTMP is not enabled by default, and no public exploit has been identified at time of analysis.
RemediationAI
Vendor-released patch: Apache bRPC 1.18.0, which includes the fix from https://github.com/apache/brpc/pull/3353; see the advisory at https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb. If immediate upgrade is not possible, disable the bRPC RTMP server component or restrict RTMP traffic to trusted clients and avoid invoking the AMF parser on untrusted input, accepting the loss of RTMP functionality or client connectivity as the trade-off. After upgrading, review and tune amf_max_string_size and amf_max_array_size as needed; the defaults are 64 MiB for strings and 1,048,576 elements for arrays, and lowering them strengthens protection while potentially rejecting legitimate large AMF payloads.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache bRPC is a C++ RPC framework whose RTMP support includes an AMF parser. The issue is CWE-789 (Memory Allocation with Excessive Size Value): the AMF long-string parser resized the destination string to the declared 32-bit length before validating that the stream actually contained that many bytes, while ECMA array and strict array parsers accepted 32-bit element counts without a configurable upper bound. The CPE string cpe:2.3:a:apache_software_foundation:apache_brpc:*:*:*:*:*:*:*:* identifies Apache bRPC broadly, with exposure limited to deployments that enable the RTMP server or directly parse untrusted AMF data. The 1.18.0 fix introduces configurable limits for AMF parsing.
Know when Apache Brpc gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Remote unauthenticated reachability over RTMP gives AV:N/AC:L/PR:N/UI:N; impact is availability-only (memory exhaustion) so C:N/I:N and A:H.
Primary rating from Vendor (apache).
Lifecycle Timeline
2DescriptionCVE.org
The RTMP AMF parser in Apache bRPC accepts AMF string lengths and array counts directly from untrusted input. A remote unauthenticated attacker who can reach a bRPC server with RTMP enabled can send a small AMF payload with an excessive declared long string length or array count, causing excessive memory allocation or resource consumption before the parser rejects the incomplete payload.
Root Cause: The AMF long string parser resized the destination string to the declared 32-bit length before validating that the stream contained that many bytes. ECMA array and strict array parsers also accepted 32-bit element counts without a configurable upper bound.
Affected Scenarios: Deployments that enable the bRPC RTMP server component and accept RTMP traffic from untrusted clients. Direct uses of the AMF parser on untrusted data are also affected.
How to Fix:
- Upgrade bRPC to version 1.18.0, which fixes this issue.
- Apply this patch: https://github.com/apache/brpc/pull/3353
Note: The fix introduces configurable AMF parsing limits. The default maximum string size is 64 MiB and the default maximum array element count is 1,048,576. Payloads above these limits are rejected. The limits can be adjusted with amf_max_string_size and amf_max_array_size.
Executive ViewAI
Apache bRPC servers that have explicitly enabled the optional RTMP component can be pushed into memory exhaustion by a single small, unauthenticated remote request, degrading or taking down services that depend on real-time streaming or messaging backends. Exposure is limited to deployments that have opted into RTMP rather than the default install base, but any such internet-reachable instance is attackable by any remote client without credentials. No public exploit code or active exploitation has been observed, so the near-term concern is availability risk for streaming-dependent workloads combined with the current absence of a vendor-issued fix.
No vendor-released patch identified at time of analysis. Disable the RTMP component wherever it is not operationally required; restrict RTMP ports to trusted source ranges; front RTMP listeners with connection/rate limiting and per-process memory caps plus memory-usage alerting.
Threat Intelligence Overview
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Apache Brpc
View allDenial of service in Apache bRPC servers that accept HTTP/2 traffic is caused by a malformed DATA frame with the PADDED
Remote unauthenticated denial of service affects Apache bRPC versions before 1.18.0 when the optional RTMP service is en
Memory exhaustion in Apache bRPC versions prior to 1.18.0 lets remote attackers force excessive preallocation on servers
A single unauthenticated request can abort an Apache bRPC server (versions before 1.18.0) that has been explicitly confi
TLS endpoint impersonation in Apache bRPC before 1.18.0 allows an on-path attacker who can redirect or intercept a clien
Remote denial of service affects Apache bRPC deployments before 1.18.0 when built on platforms where plain char is unsig
Memory exhaustion denial of service in Apache bRPC before 1.18.0 allows remote unauthenticated peers to push buffered me
Memory and CPU exhaustion in Apache bRPC's Redis-protocol handler lets remote unauthenticated clients inflate server res
Out-of-bounds write in Apache bRPC's Redis RESP parser allows remote unauthenticated attackers who can reach a bRPC serv
Denial of service in Apache bRPC before 1.18.0 allows an unauthenticated remote RTMP peer to crash the bRPC process by s
Remote denial of service in Apache bRPC (versions before 1.18.0) allows a malicious, compromised, or faulty Redis server
Remote unauthenticated denial of service in Apache bRPC before 1.18.0 allows attackers to exhaust the server thread stac
Exploit-DB