{"id":"CVE-2026-74758","kind":"vulnerability","aliases":["CVE-2026-74758"],"related":[],"title":"Apache bRPC: crafted RTMP Abort message crashes server via use-after-free","description":"A heap use-after-free in the RTMP protocol component of Apache bRPC (versions < 1.18.0) allows a remote attacker to crash a bRPC RTMP server by sending a crafted Abort control message. No authentication or application-level request is required.\n\nRoot Cause:\nWhen an RTMP Abort control message names the chunk stream that is currently being parsed (the chunk stream carrying the message itself), RtmpChunkStream::OnAbortMessage calls RtmpContext::ClearChunkStream, which deletes the RtmpChunkStream while its Feed() is still running. After the message handler returns, Feed() continues to access members of the deleted object, resulting in a heap-use-after-free.\n\nAffected Scenarios:\nbRPC servers that enable RTMP support (ServerOptions.rtmp_service set) and accept connections from untrusted networks.\n\nHow to Fix:\n1. Upgrade bRPC to version 1.18.0, which fixes this issue.\n2. Apply this patch:  https://github.com/apache/brpc/pull/3452 \n\nThe fix skips clearing the chunk stream when the Abort message targets the chunk stream that is currently being parsed.","summary":"A heap use-after-free in bRPC's RTMP support lets a remote attacker send a crafted RTMP Abort control message that deletes a chunk stream still in use. The result is a crash of the bRPC RTMP server, with no authentication needed.","severity":"high","cvss":null,"epss":0.00243,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-brpc","c++","package","rtmp","self-hosted"],"not_affected_if":["default-config","trusted-network-only"],"how_to_check":"- Check the bRPC version in use: `unknown` for exact command, look at the dependency manifest or installed package for a version below `1.18.0`\n- Check whether the server sets `ServerOptions.rtmp_service` (RTMP enabled) and accepts traffic from untrusted networks","fix":"- Upgrade Apache bRPC to `1.18.0`\n- Or apply the patch from https://github.com/apache/brpc/pull/3452","status":"open","published_at":"2026-10-21T12:17:22+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T05:02:39+00:00","updated_at":"2026-10-25T05:02:39+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T05:02:39Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache bRPC to `1.18.0`\n- Or apply the patch from https://github.com/apache/brpc/pull/3452","reach":"internet","title":"Apache bRPC: crafted RTMP Abort message crashes server via use-after-free","impact":"low","summary":"A heap use-after-free in bRPC's RTMP support lets a remote attacker send a crafted RTMP Abort control message that deletes a chunk stream still in use. The result is a crash of the bRPC RTMP server, with no authentication needed.","category":"package","nicknames":[],"who_cares":["c++","apache-brpc","rtmp","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Remote attacker crashes the bRPC RTMP server process","analyst_note":"","how_to_check":"- Check the bRPC version in use: `unknown` for exact command, look at the dependency manifest or installed package for a version below `1.18.0`\n- Check whether the server sets `ServerOptions.rtmp_service` (RTMP enabled) and accepts traffic from untrusted networks","needs_analyst":false,"not_affected_if":["default-config","trusted-network-only"],"who_is_affected":"Only servers built on bRPC that enable RTMP support by setting ServerOptions.rtmp_service and accept connections from untrusted networks are exposed. Servers without RTMP enabled, or those reachable only from trusted networks, can skip this.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000637,"input_tokens":3647,"output_tokens":544,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-74758':16A,19A '/apache/brpc/pull/3452':212C '1':196C '1.18.0':88C,201C '2':206C 'abort':5A,48B,103C,120C,222C 'accept':188C 'access':162C 'affect':176C 'allow':89C 'apach':1A,21B,85C 'apache-brpc':20B 'appli':207C 'applic':110C 'application-level':109C 'attack':43B,92C 'authent':71B,107C 'brpc':2A,22B,36B,66B,86C,96C,178C,198C 'c':23B 'call':141C 'carri':135C 'caus':116C 'chunk':54B,125C,133C,218C,226C 'clear':216C 'clearchunkstream':143C 'compon':83C 'connect':189C 'continu':160C 'control':49B,104C,121C 'craft':3A,46B,102C 'crash':7A,63B,94C 'current':129C,230C 'cve':14A,17A 'delet':52B,145C,166C 'enabl':181C 'feed':150C,159C 'fix':195C,203C,214C 'free':13A,34B,78C,175C 'github.com':211C 'github.com/apache/brpc/pull/3452':210C 'handler':157C 'heap':30B,74C,172C 'heap-use-after-fre':171C 'host':28B 'issu':205C 'let':40B 'level':111C 'member':163C 'messag':6A,50B,105C,122C,137C,156C,223C 'name':123C 'need':72B 'network':192C 'object':167C 'onabortmessag':140C 'packag':24B 'pars':131C,232C 'patch':209C 'protocol':82C 'remot':42B,91C 'request':112C 'requir':114C 'result':60B,168C 'return':158C 'root':115C 'rtmp':4A,25B,38B,47B,67B,81C,97C,119C,182C 'rtmpchunkstream':139C,147C 'rtmpcontext':142C 'run':153C 'scenario':177C 'self':27B 'self-host':26B 'send':44B,100C 'server':8A,68B,98C,179C 'serveroptions.rtmp':184C 'servic':185C 'set':186C 'skip':215C 'still':56B,152C 'stream':55B,126C,134C,219C,227C 'support':39B,183C 'target':224C 'untrust':191C 'upgrad':197C 'use':11A,32B,58B,76C,173C 'use-after-fre':10A,31B,75C 'version':87C,200C 'via':9A","nicknames":[],"mitigations":[],"who_affected":"Only servers built on bRPC that enable RTMP support by setting ServerOptions.rtmp_service and accept connections from untrusted networks are exposed. Servers without RTMP enabled, or those reachable only from trusted networks, can skip this.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T12:17:22+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-74758","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74758","severity":null,"published_at":"2026-10-21T12:17:22+00:00","modified_at":"2026-10-22T16:56:37+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-74758","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-74758","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}