Live › vulnerability › CVE-2026-54427
Go to dashboardApache bRPC's AMF parser recurses without a depth limit when reading RTMP messages, so deeply nested AMF objects or arrays exhaust the native stack. A remote RTMP peer can send such data to crash any bRPC process that parses it, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that use bRPC's RTMP support and parse AMF data from untrusted RTMP peers are exposed, including RTMP servers reading client commands, RTMP clients reading server responses, and code parsing inbound AMF script data. Direct callers of ReadAMFObject or ReadAMFArray on untrusted input are also affected. Services that do not use RTMP or AMF parsing can skip it.
No product ranges from the sources yet.
1.18.0; versions below it are affected.ReadAMFObject or ReadAMFArray on data from untrusted peers.1.18.0.128 (amf_max_depth).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Uncontrolled recursion in the AMF parser in Apache bRPC < 1.18.0 allows a remote RTMP peer to crash a bRPC process by sending deeply nested AMF objects or arrays. The parser recursively processed nested AMF containers without enforcing a depth limit, which could exhaust the native stack.
Affected Scenarios: Applications using bRPC RTMP support and parsing AMF data from an untrusted RTMP peer. This includes RTMP servers parsing client command messages, RTMP clients parsing server responses or status messages, and either side parsing inbound AMF script data such as metadata or cue points. Direct callers of ReadAMFObject or ReadAMFArray on untrusted input are also affected.
How to Fix:
Note: The fix introduces a configurable AMF nesting depth limit with default value 128. AMF objects or arrays deeper than amf_max_depth are rejected after applying the fix.
This page as .md · .json · in your agent: get_signal("CVE-2026-54427")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.