{"id":"CVE-2026-54427","kind":"vulnerability","aliases":["CVE-2026-54427"],"related":[],"title":"Apache bRPC: deeply nested AMF data from RTMP peers crashes the process","description":"Uncontrolled recursion in the AMF parser in Apache bRPC < 1.18.0 allows a remote RTMP peer to crash a bRPC process by sending deeply nested AMF objects or arrays. The parser recursively processed nested AMF containers without enforcing a depth limit, which could exhaust the native stack.\n\nAffected Scenarios:\nApplications using bRPC RTMP support and parsing AMF data from an untrusted RTMP peer. This includes RTMP servers parsing client command messages, RTMP clients parsing server responses or status messages, and either side parsing inbound AMF script data such as metadata or cue points. Direct callers of ReadAMFObject or ReadAMFArray on untrusted input are also affected.\n\nHow to Fix:\n1. Upgrade Apache bRPC to 1.18.0.\n2. Apply the patch from PR  https://github.com/apache/brpc/pull/3344 .\n\nNote:\nThe fix introduces a configurable AMF nesting depth limit with default value 128. AMF objects or arrays deeper than amf_max_depth are rejected after applying the fix.","summary":"Apache bRPC's AMF parser recurses without a depth limit when reading RTMP messages, so deeply nested AMF objects or arrays exhaust the native stack. A remote RTMP peer can send such data to crash any bRPC process that parses it, causing denial of service.","severity":"high","cvss":null,"epss":0.00164,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["brpc","c++","rtmp","runtime","self-hosted"],"not_affected_if":["no-amf-parsing","no-rtmp","trusted-peers-only"],"how_to_check":"- Check the bRPC version in use against `1.18.0`; versions below it are affected.\n- Look for RTMP support or calls to `ReadAMFObject` or `ReadAMFArray` on data from untrusted peers.","fix":"- Upgrade Apache bRPC to `1.18.0`.\n- Alternatively, apply the patch from https://github.com/apache/brpc/pull/3344, which adds a default AMF nesting depth limit of `128` (`amf_max_depth`).","status":"open","published_at":"2026-10-21T12:17:21+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T05:02:51+00:00","updated_at":"2026-10-25T05:02:51+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-25T05:02:51Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache bRPC to `1.18.0`.\n- Alternatively, apply the patch from https://github.com/apache/brpc/pull/3344, which adds a default AMF nesting depth limit of `128` (`amf_max_depth`).","reach":"network","title":"Apache bRPC: deeply nested AMF data from RTMP peers crashes the process","impact":"medium","summary":"Apache bRPC's AMF parser recurses without a depth limit when reading RTMP messages, so deeply nested AMF objects or arrays exhaust the native stack. A remote RTMP peer can send such data to crash any bRPC process that parses it, causing denial of service.","category":"runtime","nicknames":[],"who_cares":["bRPC","rtmp","c++","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"remote peer crashes the bRPC process via stack exhaustion","analyst_note":"","how_to_check":"- Check the bRPC version in use against `1.18.0`; versions below it are affected.\n- Look for RTMP support or calls to `ReadAMFObject` or `ReadAMFArray` on data from untrusted peers.","needs_analyst":false,"not_affected_if":["no-rtmp","no-amf-parsing","trusted-peers-only"],"who_is_affected":"Applications that use bRPC's RTMP support and parse AMF data from untrusted RTMP peers are exposed, including RTMP servers reading client commands, RTMP clients reading server responses, and code parsing inbound AMF script data. Direct callers of ReadAMFObject or ReadAMFArray on untrusted input are also affected. Services that do not use RTMP or AMF parsing can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000681,"input_tokens":3636,"output_tokens":634,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-54427':15A,18A '/apache/brpc/pull/3344':192C '1':178C '1.18.0':80C,183C '128':206C '2':184C 'affect':117C,174C 'allow':81C 'also':173C 'amf':5A,29B,43B,75C,95C,104C,126C,154C,199C,207C,213C 'apach':1A,26B,78C,180C 'appli':185C,219C 'applic':119C 'array':46B,98C,210C 'brpc':2A,19B,27B,62B,79C,89C,121C,181C 'c':20B 'caller':164C 'caus':67B 'client':138C,142C 'command':139C 'configur':198C 'contain':105C 'could':112C 'crash':10A,60B,87C 'cue':161C 'cve':13A,16A 'data':6A,58B,127C,156C 'deeper':211C 'deepli':3A,41B,93C 'default':204C 'denial':68B 'depth':34B,109C,201C,215C 'direct':163C 'either':150C 'enforc':107C 'exhaust':47B,113C 'fix':177C,195C,221C 'github.com':191C 'github.com/apache/brpc/pull/3344':190C 'host':25B 'inbound':153C 'includ':134C 'input':171C 'introduc':196C 'limit':35B,110C,202C 'max':214C 'messag':39B,140C,148C 'metadata':159C 'nativ':49B,115C 'nest':4A,42B,94C,103C,200C 'note':193C 'object':44B,96C,208C 'pars':65B,125C,137C,143C,152C 'parser':30B,76C,100C 'patch':187C 'peer':9A,54B,85C,132C 'point':162C 'pr':189C 'process':12A,63B,90C,102C 'read':37B 'readamfarray':168C 'readamfobject':166C 'recurs':31B,72C,101C 'reject':217C 'remot':52B,83C 'respons':145C 'rtmp':8A,21B,38B,53B,84C,122C,131C,135C,141C 'runtim':22B 'scenario':118C 'script':155C 'self':24B 'self-host':23B 'send':56B,92C 'server':136C,144C 'servic':70B 'side':151C 'stack':50B,116C 'status':147C 'support':123C 'uncontrol':71C 'untrust':130C,170C 'upgrad':179C 'use':120C 'valu':205C 'without':32B,106C","nicknames":[],"mitigations":[],"who_affected":"Applications that use bRPC's RTMP support and parse AMF data from untrusted RTMP peers are exposed, including RTMP servers reading client commands, RTMP clients reading server responses, and code parsing inbound AMF script data. Direct callers of ReadAMFObject or ReadAMFArray on untrusted input are also affected. Services that do not use RTMP or AMF parsing can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T12:17:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-54427","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54427","severity":null,"published_at":"2026-10-21T12:17:21+00:00","modified_at":"2026-10-22T16:56:37+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-54427","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-54427","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}