---
id: "CVE-2026-74758"
kind: "vulnerability"
aliases: ["CVE-2026-74758"]
title: "Apache bRPC: crafted RTMP Abort message crashes server via use-after-free"
severity: "high"
cvss: null
epss: 0.00243
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-brpc", "c++", "package", "rtmp", "self-hosted"]
not_affected_if: ["default-config", "trusted-network-only"]
published_at: "2026-10-21T12:17:22+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T05:02:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74758", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-74758", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Apache bRPC: crafted RTMP Abort message crashes server via use-after-free

A heap use-after-free in bRPC's RTMP support lets a remote attacker send a crafted RTMP Abort control message that deletes a chunk stream still in use. The result is a crash of the bRPC RTMP server, with no authentication needed.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the bRPC version in use: `unknown` for exact command, look at the dependency manifest or installed package for a version below `1.18.0`
- Check whether the server sets `ServerOptions.rtmp_service` (RTMP enabled) and accepts traffic from untrusted networks

## Fix

- Upgrade Apache bRPC to `1.18.0`
- Or apply the patch from https://github.com/apache/brpc/pull/3452

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-74758
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-74758

## From the sources

A heap use-after-free in the RTMP protocol component of Apache bRPC (versions < 1.18.0) allows a remote attacker to crash a bRPC RTMP server by sending a crafted Abort control message. No authentication or application-level request is required.

Root Cause:
When an RTMP Abort control message names the chunk stream that is currently being parsed (the chunk stream carrying the message itself), RtmpChunkStream::OnAbortMessage calls RtmpContext::ClearChunkStream, which deletes the RtmpChunkStream while its Feed() is still running. After the message handler returns, Feed() continues to access members of the deleted object, resulting in a heap-use-after-free.

Affected Scenarios:
bRPC servers that enable RTMP support (ServerOptions.rtmp_service set) and accept connections from untrusted networks.

How to Fix:
1. Upgrade bRPC to version 1.18.0, which fixes this issue.
2. Apply this patch:  https://github.com/apache/brpc/pull/3452 

The fix skips clearing the chunk stream when the Abort message targets the chunk stream that is currently being parsed.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_