Skip to content
VulniPulse
Sign in
Advisory severityUnratedApache Software Foundation Updated

Advisory [CVE-2026-54427] Uncontrolled recursion in the AMF parser in Apache bRPC < 1.18.0 allows a remote RTMP peer to crash a bRPC process by sending deeply nested AMF objects or arrays

This security Apache Software Foundation advisory covers CVE-2026-54427; related products: Apache bRPC.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-54427 Source published Source updated

VulniPulse record published Record updated

CVE-2026-54427
Related products & platforms
Apache Software FoundationUnclassified
Open source advisory

Android app · Google Play

Monitor future Apache Software Foundation CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features

Summary

Uncontrolled recursion in the AMF parser in Apache bRPC < 1.18.0 allows a remote RTMP peer to crash a bRPC process by sending deeply nested AMF objects or arrays. The parser recursively processed nested AMF containers without enforcing a depth limit, which could exhaust the native stack.

Affected Scenarios: Applications using bRPC RTMP support and parsing AMF data from an untrusted RTMP peer.

This includes RTMP servers parsing client command messages, RTMP clients parsing server responses or status messages, and either side parsing inbound AMF script data such as metadata or cue points. Direct callers of ReadAMFObject or ReadAMFArray on untrusted input are also affected.

How to Fix: 1.

Upgrade Apache bRPC to 1.18.0. 2.

Apply the patch from PR.

Note: The fix introduces a configurable AMF nesting depth limit with default value 128.

AMF objects or arrays deeper than amf_max_depth are rejected after applying the fix.

Affected versions
  • Apache bRPC before 1.18.0

Official advisory · medium-confidence parse· fetched 1 hour ago·verify at source

Fixed versions
  • 1.18.0

Official advisory · medium-confidence parse· fetched 1 hour ago·verify at source

Mitigation checklist

Recommended fix / mitigation
  • The parser recursively processed nested AMF containers without enforcing a depth limit, which could exhaust the native stack.
  • Upgrade Apache bRPC to 1.18.0.
  • Apply the patch from PR https://github.com/apache/brpc/pull/3344.
  • Note: The fix introduces a configurable AMF nesting depth limit with default value 128.

Official advisory · medium-confidence parse· fetched 1 hour ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.