NULL Pointer Dereference in Apache bRPC RTMP Protocol

CVE-2026-82953

What is CVE-2026-82953?

A NULL pointer dereference vulnerability exists in the RTMP protocol implementation of Apache bRPC, allowing remote attackers to crash the server through a crafted createStream command. When a request is rejected, the server attempts to handle the rejection. If the client closes the connection prematurely, the server attempts to dereference a null stream pointer, which results in a process crash. This vulnerability affects all versions below 1.18.0. To mitigate the risk, users should upgrade to version 1.18.0 or apply the recommended patch.

References