---
id: "CVE-2026-54427"
kind: "vulnerability"
aliases: ["CVE-2026-54427"]
title: "Apache bRPC: deeply nested AMF data from RTMP peers crashes the process"
severity: "high"
cvss: null
epss: 0.00164
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["brpc", "c++", "rtmp", "runtime", "self-hosted"]
not_affected_if: ["no-amf-parsing", "no-rtmp", "trusted-peers-only"]
published_at: "2026-10-21T12:17:21+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T05:02:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54427", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-54427", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Apache bRPC: deeply nested AMF data from RTMP peers crashes the process

Apache bRPC's AMF parser recurses without a depth limit when reading RTMP messages, so deeply nested AMF objects or arrays exhaust the native stack. A remote RTMP peer can send such data to crash any bRPC process that parses it, causing denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the bRPC version in use against `1.18.0`; versions below it are affected.
- Look for RTMP support or calls to `ReadAMFObject` or `ReadAMFArray` on data from untrusted peers.

## Fix

- Upgrade Apache bRPC to `1.18.0`.
- Alternatively, apply the patch from https://github.com/apache/brpc/pull/3344, which adds a default AMF nesting depth limit of `128` (`amf_max_depth`).

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-54427
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-54427

## From the sources

Uncontrolled recursion in the AMF parser in Apache bRPC < 1.18.0 allows a remote RTMP peer to crash a bRPC process by sending deeply nested AMF objects or arrays. The parser recursively processed nested AMF containers without enforcing a depth limit, which could exhaust the native stack.

Affected Scenarios:
Applications using bRPC RTMP support and parsing AMF data from an untrusted RTMP peer. This includes RTMP servers parsing client command messages, RTMP clients parsing server responses or status messages, and either side parsing inbound AMF script data such as metadata or cue points. Direct callers of ReadAMFObject or ReadAMFArray on untrusted input are also affected.

How to Fix:
1. Upgrade Apache bRPC to 1.18.0.
2. Apply the patch from PR  https://github.com/apache/brpc/pull/3344 .

Note:
The fix introduces a configurable AMF nesting depth limit with default value 128. AMF objects or arrays deeper than amf_max_depth are rejected after applying the fix.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_