Uncontrolled Recursion Vulnerability in Apache bRPC RTMP Parser

CVE-2026-54427

What is CVE-2026-54427?

The AMF parser in Apache bRPC versions prior to 1.18.0 is impacted by an uncontrolled recursion vulnerability. This issue enables a remote RTMP peer to crash a bRPC process through the submission of deeply nested AMF objects or arrays. The parser does not enforce a depth limit when processing these nested containers, which can lead to the exhaustion of the native stack. Applications using bRPC with RTMP support are particularly at risk, especially when parsing AMF data from untrusted sources. To mitigate this vulnerability, users should upgrade to Apache bRPC version 1.18.0 or later, where a configurable AMF nesting depth limit is introduced. This limit defaults to 128, rejecting objects or arrays exceeding this depth.

References