EUVD-2026-107182
GHSA-jhf7-xcw3-gmv5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach RTMP-enabled bRPC server
-
DeliveryOpen RTMP connection
-
ExploitSend crafted Abort control message
-
ExecutionFree chunk stream during active parse
-
PersistUse-after-free in Feed()
-
ImpactServer process crash (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The bRPC server must have RTMP support explicitly enabled (ServerOptions.rtmp_service set) and accept RTMP connections from untrusted networks - this is a non-default configuration and is the primary limiting factor. Given that condition, exploitation is remote and unauthenticated: the attacker only needs to establish an RTMP session and send a single crafted Abort control message that targets the chunk stream currently being parsed, with no credentials, no user interaction, and no application-level request. Affected builds are Apache bRPC versions earlier than 1.18.0; servers that do not enable the RTMP service are not exposed. |
| Impact | No CVSS vector is provided by the source (CVSS Score/Vector: N/A), and there is no EPSS score, no CISA KEV listing, and no public POC - so the quantitative exploitation signals are absent and cannot be cross-referenced. Based on the description, this is a remote, pre-authentication denial-of-service: a crafted RTMP Abort control message triggers a CWE-416 heap use-after-free that crashes the bRPC RTMP server, with no authentication or application-level request required. The impact is confined to availability (process crash); the root-cause analysis gives no indication of code execution or information disclosure, so this reads as a high-severity DoS rather than a critical RCE. The real-world priority is tempered by a key limiting condition: the flaw is only reachable when a bRPC server explicitly enables RTMP support (ServerOptions.rtmp_service) and exposes it to untrusted networks, which is not a default deployment. Exploitation status is 'no public exploit identified at time of analysis'; absence of KEV/EPSS/POC reflects missing data rather than confirmed low interest. My independent assessment is network/low-complexity/unauthenticated with availability-only impact (roughly CVSS 3.1 7.5), but note the vendor has not published a numeric score to corroborate this. |
| Exploit ScenarioDerived | An attacker who can reach an internet- or network-exposed bRPC server that has RTMP support enabled opens an RTMP connection and sends a crafted Abort control message naming the chunk stream currently being parsed. This frees the RtmpChunkStream object while its Feed() routine is still executing, causing a heap use-after-free that crashes the server process and denies service to legitimate clients. No authentication or application-level request is needed, but no public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Remote unauthenticated denial of service affects Apache bRPC versions before 1.18.0 when the optional RTMP service is enabled, where a single crafted RTMP Abort control message that names the chunk stream currently being parsed triggers a heap use-after-free and crashes the server. Exploitation requires the non-default ServerOptions.rtmp_service configuration and network reachability to the RTMP listener; with that precondition, no credentials, user interaction, or application-level request are needed. The assessed impact is availability-only (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and no public exploit code, EPSS score, or CISA KEV entry was identified at time of analysis.
RemediationAI
Upgrade Apache bRPC to version 1.18.0, the vendor-released fix, or apply the upstream change in https://github.com/apache/brpc/pull/3452 if a backport is required; the patch skips clearing a chunk stream when an Abort message targets the stream currently being parsed. If upgrading cannot be done immediately, disable RTMP support by leaving ServerOptions.rtmp_service unset or removing the RTMP listener, with the trade-off that RTMP streaming clients can no longer connect; alternatively, restrict the RTMP port to trusted source networks using firewall or ACL rules, understanding that this reduces exposure but does not remediate the use-after-free and still permits attack traffic from any allowed peer. Review the vendor advisory at https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb for any additional guidance, and monitor RTMP-enabled bRPC processes for crash restarts as a detection signal.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache bRPC is a C++ RPC framework that optionally exposes an RTMP protocol service for streaming clients. RTMP multiplexes messages over chunk streams, and an Abort control message instructs the peer to discard a named chunk stream. In affected builds, when an Abort message names the very chunk stream that is currently being parsed, RtmpChunkStream::OnAbortMessage calls RtmpContext::ClearChunkStream, which deletes the active RtmpChunkStream object while its Feed() method is still executing. After the message handler returns, Feed() continues to dereference members of the freed object, producing a heap use-after-free (CWE-416) that typically manifests as a server crash. The flaw is a lifecycle and object-ownership error in the RTMP chunk parsing state machine rather than an application-logic issue, and the upstream fix in PR 3452 avoids clearing the chunk stream when the Abort message targets the stream currently being parsed. The CPE cpe:2.3:a:apache_software_foundation:apache_brpc:*:*:*:*:*:*:*:* reflects that all bRPC releases before the fixed version are in scope, though only deployments with RTMP support enabled are reachable.
Know when Apache Brpc gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Remote unauthenticated single-message trigger gives AV:N/AC:L/PR:N/UI:N; impact is a server crash only, so C:N/I:N/A:H with no scope change.
Primary rating from Vendor (apache).
Lifecycle Timeline
2DescriptionCVE.org
A heap use-after-free in the RTMP protocol component of Apache bRPC (versions < 1.18.0) allows a remote attacker to crash a bRPC RTMP server by sending a crafted Abort control message. No authentication or application-level request is required.
Root Cause: When an RTMP Abort control message names the chunk stream that is currently being parsed (the chunk stream carrying the message itself), RtmpChunkStream::OnAbortMessage calls RtmpContext::ClearChunkStream, which deletes the RtmpChunkStream while its Feed() is still running. After the message handler returns, Feed() continues to access members of the deleted object, resulting in a heap-use-after-free.
Affected Scenarios: bRPC servers that enable RTMP support (ServerOptions.rtmp_service set) and accept connections from untrusted networks.
How to Fix:
- Upgrade bRPC to version 1.18.0, which fixes this issue.
- Apply this patch: https://github.com/apache/brpc/pull/3452
The fix skips clearing the chunk stream when the Abort message targets the chunk stream that is currently being parsed.
Executive ViewAI
Organizations running Apache bRPC with the optional RTMP service enabled face an availability risk: a single unauthenticated network message can crash the server, taking dependent applications offline until restarted. Exposure is gated by a non-default configuration, so the immediate priority for leadership is determining which teams have actually turned RTMP on rather than treating the whole estate as affected. With no public exploit code and no confirmed active exploitation, this is a contained availability concern that still warrants tracked remediation before an internet-facing RTMP listener becomes a target.
No vendor-released patch identified at time of analysis; interim mitigations are to disable the optional RTMP service (ServerOptions.rtmp_service) on any instance that does not require it, and where RTMP must remain enabled, network-restrict the RTMP listener to trusted sources via firewall or security-group rules, supplemented by crash monitoring and automated restart as a detection and containment backstop.
Threat Intelligence Overview
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Apache Brpc
View allDenial of service in Apache bRPC servers that accept HTTP/2 traffic is caused by a malformed DATA frame with the PADDED
Memory exhaustion in Apache bRPC versions prior to 1.18.0 lets remote attackers force excessive preallocation on servers
A single unauthenticated request can abort an Apache bRPC server (versions before 1.18.0) that has been explicitly confi
TLS endpoint impersonation in Apache bRPC before 1.18.0 allows an on-path attacker who can redirect or intercept a clien
Remote denial of service affects Apache bRPC deployments before 1.18.0 when built on platforms where plain char is unsig
Memory exhaustion denial of service in Apache bRPC before 1.18.0 allows remote unauthenticated peers to push buffered me
Memory and CPU exhaustion in Apache bRPC's Redis-protocol handler lets remote unauthenticated clients inflate server res
Out-of-bounds write in Apache bRPC's Redis RESP parser allows remote unauthenticated attackers who can reach a bRPC serv
Memory exhaustion in Apache bRPC's RTMP AMF parser allows unauthenticated remote attackers to consume excessive resource
Denial of service in Apache bRPC before 1.18.0 allows an unauthenticated remote RTMP peer to crash the bRPC process by s
Remote denial of service in Apache bRPC (versions before 1.18.0) allows a malicious, compromised, or faulty Redis server
Remote unauthenticated denial of service in Apache bRPC before 1.18.0 allows attackers to exhaust the server thread stac
Exploit-DB