Description
A heap use-after-free in the RTMP protocol component of Apache bRPC (versions < 1.18.0) allows a remote attacker to crash a bRPC RTMP server by sending a crafted Abort control message. No authentication or application-level request is required.

Root Cause:
When an RTMP Abort control message names the chunk stream that is currently being parsed (the chunk stream carrying the message itself), RtmpChunkStream::OnAbortMessage calls RtmpContext::ClearChunkStream, which deletes the RtmpChunkStream while its Feed() is still running. After the message handler returns, Feed() continues to access members of the deleted object, resulting in a heap-use-after-free.

Affected Scenarios:
bRPC servers that enable RTMP support (ServerOptions.rtmp_service set) and accept connections from untrusted networks.

How to Fix:
1. Upgrade bRPC to version 1.18.0, which fixes this issue.
2. Apply this patch:  https://github.com/apache/brpc/pull/3452

The fix skips clearing the chunk stream when the Abort message targets the chunk stream that is currently being parsed.
Published: 2026-10-21
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service (remote crash)
Action: Patch
AI Analysis

Impact

A heap use‑after‑free occurs in the RTMP protocol component of Apache bRPC (versions < 1.18.0) when a crafted Abort control message targets the chunk stream that is currently being parsed. The vulnerability allows a remote attacker to trigger the server’s Feed() routine to access freed memory, causing the server to crash. This falls under CWE‑416 and results in a denial‑of‑service without requiring authentication or any application‑level request.

Affected Systems

Apache Software Foundation’s Apache bRPC, any server running a version earlier than 1.18.0 that has the RTMP service enabled via ServerOptions.rtmp_service and that accepts connections from untrusted networks.

Risk and Exploitability

Because the flaw can be triggered by an unauthenticated remote message, the attack vector is remote and inexpensive for an adversary. An attacker can simply send a crafted Abort message to cause the RTMP server to crash, disrupting availability of the service. The EPSS score is < 1% and the CVSS score of 7.5 indicates a medium‑to‑high severity. The vulnerability is not listed in the CISA KEV catalogue, but the combination of medium‑to‑high impact and lack of controls makes exploitation risk high and the need for a patch urgent.

Generated by OpenCVE AI on October 30, 2026 at 18:46 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Apache bRPC to version 1.18.0 or later.
  • Apply the upstream patch linked at https://github.com/apache/brpc/pull/3452 to eliminate the use‑after‑free.
  • If an update cannot be performed immediately, disable the RTMP service by removing or commenting out ServerOptions.rtmp_service to prevent the vulnerable code path from executing.
  • Limit inbound RTMP traffic to trusted networks or block the port at the firewall until remediation is in place.

Generated by OpenCVE AI on October 30, 2026 at 18:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache brpc
Vendors & Products Apache
Apache brpc

Wed, 21 Oct 2026 12:00:00 +0000

Type Values Removed Values Added
Description A heap use-after-free in the RTMP protocol component of Apache bRPC (versions < 1.18.0) allows a remote attacker to crash a bRPC RTMP server by sending a crafted Abort control message. No authentication or application-level request is required. Root Cause: When an RTMP Abort control message names the chunk stream that is currently being parsed (the chunk stream carrying the message itself), RtmpChunkStream::OnAbortMessage calls RtmpContext::ClearChunkStream, which deletes the RtmpChunkStream while its Feed() is still running. After the message handler returns, Feed() continues to access members of the deleted object, resulting in a heap-use-after-free. Affected Scenarios: bRPC servers that enable RTMP support (ServerOptions.rtmp_service set) and accept connections from untrusted networks. How to Fix: 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch:  https://github.com/apache/brpc/pull/3452 The fix skips clearing the chunk stream when the Abort message targets the chunk stream that is currently being parsed.
Title Apache bRPC: Heap Use-After-Free in RTMP Abort Message Handling
Weaknesses CWE-416
References

Subscriptions

Apache Brpc
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-30T16:47:23.207Z

Reserved: 2026-08-15T08:40:10.439Z

Link: CVE-2026-74758

cve-icon Vulnrichment

Updated: 2026-10-30T16:47:07.985Z

cve-icon NVD

Status : Deferred

Published: 2026-10-21T12:17:22.863

Modified: 2026-10-30T17:17:28.090

Link: CVE-2026-74758

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-30T19:00:17Z

Weaknesses