Uncontrolled recursion in the AMF parser of Apache bRPC allows a remote RTMP peer to send deeply nested AMF objects or arrays that cause the parser to traverse without a depth limit, exhausting the native stack and crashing the bRPC process. The resulting crash leads to a denial of service for the affected application, interrupting any RTMP server or client that relies on bRPC for AMF data handling. Because the bug is triggered by untrusted AMF input, any inbound AMF script data from a malicious peer can exploit the flaw.

The vulnerability affects Apache bRPC versions earlier than 1.18.0, shipped by the Apache Software Foundation. Systems using bRPC RTMP support that parse AMF data from untrusted RTMP peers, including RTMP servers processing client command messages, RTMP clients parsing server responses, or either side handling inbound AMF script data such as metadata or cue points, are in scope.

The issue is exploitable by an attacker who can establish a connection to a bRPC-enabled RTMP endpoint and send crafted AMF payloads; the attack vector is therefore remote network access to the RTMP service. An EPSS score of < 1% and the vulnerability is not listed in the CISA KEV catalog, but the lack of a stack depth guard indicates a high likelihood of successful denial-of-service exploitation once an untrusted peer supplies an excessively nested payload. Based on the description, it is inferred that no authentication or privilege checks are required beyond the ability to transmit AMF data.