Uncontrolled Memory Allocation in Apache bRPC RTMP Server

CVE-2026-56387

What is CVE-2026-56387?

The RTMP AMF parser in Apache bRPC is susceptible to a vulnerability that allows remote unauthenticated attackers to manipulate memory allocation. By sending carefully crafted AMF payloads with exaggerated string lengths or array counts, an attacker can lead to excessive memory consumption before the parser discards the incomplete input. This vulnerability affects installations that deploy the bRPC RTMP server and accept data from untrusted clients. To mitigate the risks associated with this issue, users are advised to upgrade to bRPC version 1.18.0 or apply the necessary patch, which introduces configurable limits to AMF parsing.

References