CVE-2026-54427None▾ SunlitUncontrolled recursion in the AMF parser in Apache bRPC < 1.18.0 allows a remote RTMP peer to crash a bRPC process by sending deeply nested AMF objects or arrays. The parser recursively processed nested AMF containers without enforcing a…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Uncontrolled recursion in the AMF parser in Apache bRPC < 1.18.0 allows a remote RTMP peer to crash a bRPC process by sending deeply nested AMF objects or arrays. The parser recursively processed nested AMF containers without enforcing a depth limit, which could exhaust the native stack.
Affected Scenarios: Applications using bRPC RTMP support and parsing AMF data from an untrusted RTMP peer. This includes RTMP servers parsing client command messages, RTMP clients parsing server responses or status messages, and either side parsing inbound AMF script data such as metadata or cue points. Direct callers of ReadAMFObject or ReadAMFArray on untrusted input are also affected.
How to Fix:
Note: The fix introduces a configurable AMF nesting depth limit with default value 128. AMF objects or arrays deeper than amf_max_depth are rejected after applying the fix.
apache/brpc < 1.18.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-82230NoneApache bRPC: Stack Exhaustion via Unbounded Recursion in mcpack2pb Parser
CVE-2026-54425NoneApache bRPC: Stack Exhaustion via Recursive HPACK Dynamic Table Size Update Decoding
CVE-2026-54426NoneApache bRPC: Stack Exhaustion via Unbounded Recursion in Redis Reply Parser
CVE-2026-56387NoneApache bRPC: Remote Memory Exhaustion in RTMP AMF Parser
CVE-2026-56388NoneApache bRPC: Out-of-Bounds Write in Redis Command Parser
CVE-2026-58064NoneApache bRPC: Denial of Service via Unbounded Redis Inline Command Allocation