Apache bRPC EUVD-2026-107171

Exploitation requires that the target application uses bRPC's RTMP support and parses AMF data from an untrusted RTMP peer - specifically an RTMP server parsing client command messages, an RTMP client parsing server responses/status messages, either side parsing inbound AMF script data (metadata/cue points), or any direct caller of ReadAMFObject/ReadAMFArray on untrusted input. No authentication is needed and the attacker only needs an RTMP connection, but the limiting factor is this RTMP/AMF code path being enabled and exposed to untrusted peers; deployments not using bRPC RTMP, or only exchanging AMF with trusted peers, are not exploitable. After upgrading, AMF nested deeper than amf_max_depth (default 128) is rejected, so misconfiguring a very high depth limit would re-enable risk.

This is a denial-of-service vulnerability (CWE-674, uncontrolled recursion) in the AMF parser of Apache bRPC < 1.18.0, where deeply nested AMF objects/arrays exhaust the native stack and crash the process. No CVSS score or vector was provided in the input, no EPSS probability is available, there is no CISA KEV listing, no public exploit code is referenced, and no SSVC decision data is supplied - so every exploitation-likelihood signal is MISSING and risk must be inferred from the description alone. Based on the description the attack is network-reachable from an untrusted RTMP peer with no authentication and low complexity (just send malformed AMF), which maps to a high-availability-impact-only issue; crafting deeply nested AMF is trivial, so if an exposed bRPC RTMP endpoint parses untrusted AMF, real-world DoS risk is meaningful. However, impact is strictly availability (process crash) with no confidentiality or integrity effect, and exploitation is gated on the target actually using bRPC's RTMP/AMF support against untrusted peers - a specific, non-universal deployment condition. Net: this is a credible but bounded DoS that warrants prompt patching for anyone exposing bRPC RTMP to untrusted networks, not a critical RCE-class emergency; absent EPSS/KEV/POC data, treat active-exploitation likelihood as unknown rather than elevated.

An attacker who can reach a bRPC-based RTMP server (or who controls an RTMP server a bRPC client connects to) sends a command, response, or script-data message containing AMF objects/arrays nested hundreds of levels deep. The recursive ReadAMFObject/ReadAMFArray parsing overflows the native stack, crashing the bRPC process and denying service to legitimate clients. No public exploit is identified at time of analysis, but the technique is trivial to script given the public patch describing the depth limit.