The RTMP AMF parser in Apache bRPC unconditionally reads declared string lengths and array element counts from untrusted input without first validating that the data contains that many bytes. An attacker can therefore send a small AMF payload that specifies an excessively large string length or array count. The parser then attempts to allocate a proportionally large amount of memory or resources before rejecting the packet, leading to resource exhaustion or a process crash. This flaw is a classic case of excessive resource allocation (CWE‑770) and unchecked memory allocation (CWE‑789).

Deployments running Apache bRPC with the RTMP server component enabled and accepting traffic from untrusted clients are affected. Direct use of the AMF parser on external data is also vulnerable. All versions prior to 1.18.0 are impacted; the issue is fixed in bRPC 1.18.0, which introduces configurable limits on string size (default 64 MiB) and array element count (default 1,048,576).

The vulnerability can be triggered remotely over the network with simple AMF traffic and requires no authentication, making it a straightforward denial‑of‑service vector. With a CVSS score of 7.5 the flaw is rated high severity. The EPSS score is reported as < 1 %, indicating a very low probability of exploitation in the current data set, and the vulnerability is not listed in CISA KEV. Nevertheless, the impact could bring a bRPC service down if not mitigated, so the risk remains significant.