Heap Use-After-Free Vulnerability in Apache bRPC RTMP Component

CVE-2026-74758

What is CVE-2026-74758?

A vulnerability in the RTMP protocol component of Apache bRPC allows remote attackers to crash a bRPC RTMP server by sending a specially crafted Abort control message. This occurs due to a heap use-after-free condition when the RTMP Abort message references the currently parsing chunk stream. Exploitation does not require authentication or specific application-level requests, making affected bRPC servers, particularly those allowing RTMP support and accepting connections from untrusted networks, susceptible to disruptions. Upgrading to bRPC version 1.18.0 or applying the provided patch is essential to mitigate this risk.

References