CVE-2026-74758: Apache bRPC: Heap Use-After-Free in RTMP Abort Message Handling
This Apache advisory covers CVE-2026-74758 in Apache bRPC.
- CVE-2026-74758
Key facts
- CISA KEV
- Not listed (catalogue checked )
- Affected
- Apache bRPC before 1.18.0
- Fixed in
- 1.18.0
- Source published
- Source revised
- Listed by VulniPulse
- Record changed
Compiled by VulniPulse from the linked sources. How records are collected and checked.
Affected products & platforms
Description
A heap use-after-free in the RTMP protocol component of Apache bRPC (versions < 1.18.0) allows a remote attacker to crash a bRPC RTMP server by sending a crafted Abort control message. No authentication or application-level request is required.
Root Cause: When an RTMP Abort control message names the chunk stream that is currently being parsed (the chunk stream carrying the message itself), RtmpChunkStream::OnAbortMessage calls RtmpContext::ClearChunkStream, which deletes the RtmpChunkStream while its Feed() is still running.
After the message handler returns, Feed() continues to access members of the deleted object, resulting in a heap-use-after-free.
Affected Scenarios: bRPC servers that enable RTMP support (ServerOptions.rtmp_service set) and accept connections from untrusted networks.
How to Fix: 1.
Upgrade bRPC to version 1.18.0, which fixes this issue. 2.
Apply this patch:
The fix skips clearing the chunk stream when the Abort message targets the chunk stream that is currently being parsed.
Text from the source record.
- Apache bRPC before 1.18.0
Official advisory · medium-confidence parse· fetched ·verify at source
How to fix CVE-2026-74758
Upgrade to a fixed release named by Apache:
- 1.18.0
Vendor guidance
- Affected Scenarios: bRPC servers that enable RTMP support (ServerOptions.rtmp_service set) and accept connections from untrusted networks.
- Upgrade bRPC to version 1.18.0, which fixes this issue.
- Apply this patch: https://github.com/apache/brpc/pull/3452 The fix skips clearing the chunk stream when the Abort message targets the chunk stream that is currently being parsed.
More Apache Software Foundation advisories
CVE-2026-90484Oct 21, 2026The MySQL client response parser in Apache bRPC dereferences a null pointerCVE-2026-87849Oct 21, 2026The Discovery naming-service reply parser in Apache bRPC (versions < 1.18.0) callsCVE-2026-86249Oct 21, 2026Apache bRPC: Authentication bypassCVE-2026-86147Oct 21, 2026Apache bRPC: Arbitrary file creation/truncationCVE-2026-86146Oct 21, 2026Apache bRPC: HTTP Request Smuggling and Header InjectionCVE-2026-84748Oct 21, 2026Apache bRPC: Builtin services reachable from the public port
Apache Software Foundation advisories, October 2026All Apache Software Foundation advisories
Get an email when Apache publishes the next one.
See Apache's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor future Apache Software Foundation CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
