Description
NULL pointer dereference in the RTMP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to crash the server (denial of service) via a crafted createStream command.

Root Cause:
When an RTMP service rejects a createStream request by returning a null stream from RtmpService::NewStream(), the server sends an error response to the client. If writing this rejection response fails (for example, because the client closes the connection immediately after sending the createStream command), the error-handling path in RtmpChunkStream::OnCreateStream() dereferences the null stream pointer to access stream->_onfail_id, causing the process to crash.

Affected Scenarios:
Run an Apache bRPC RTMP server whose RtmpService::NewStream() may return null (i.e., the service rejects createStream requests). A remote client that sends a createStream command and then closes the connection before the rejection response is written can crash the server.

How to Fix:
(Choose one of the following options)
1. Upgrade bRPC to version 1.18.0, which fixes this issue.
2. Apply this patch: https://github.com/apache/brpc/pull/3508
Published: 2026-10-21
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

A null pointer dereference is introduced in the error handling of the RTMP createStream command. When a client sends a createStream request that is rejected and immediately closes the connection, the server’s error path dereferences a null stream pointer to access stream->_onfail_id, causing the bRPC process to crash. The result is a denial‑of‑service that can be triggered remotely over the RTMP protocol. This flaw is a classic instance of CWE-476.

Affected Systems

All deployments of Apache bRPC running any version older than 1.18.0 on any supported operating system. The vulnerability resides in the RTMP protocol implementation and applies to any environment that exposes an RTMP endpoint.

Risk and Exploitability

The CVSS score of 5.3 and the EPSS score below 1% suggest a moderate severity and a very low but nonzero chance of exploitation. The flaw remains exploitable by any remote host that can connect to the exposed RTMP port, and once exploited it causes an unrecoverable crash. Because the issue does not require elevated privileges and the server can be repeatedly targeted, the overall threat is significant, but still aligned with the moderate CVSS score. The lack of a KEV listing does not reduce the need for patching; unpatched servers can be repeatedly crashed if exposed.

Generated by OpenCVE AI on October 26, 2026 at 16:09 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Apache bRPC to version 1.18.0, which contains the corrective patch.
  • If an upgrade cannot be performed immediately, apply the patch from pull request 3508 to close the null‑pointer dereference path.
  • Limit access to the RTMP endpoint or disable it entirely while remediation is pending to prevent exploitation of the flaw.

Generated by OpenCVE AI on October 26, 2026 at 16:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache brpc
Vendors & Products Apache
Apache brpc

Wed, 21 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Description NULL pointer dereference in the RTMP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to crash the server (denial of service) via a crafted createStream command. Root Cause: When an RTMP service rejects a createStream request by returning a null stream from RtmpService::NewStream(), the server sends an error response to the client. If writing this rejection response fails (for example, because the client closes the connection immediately after sending the createStream command), the error-handling path in RtmpChunkStream::OnCreateStream() dereferences the null stream pointer to access stream->_onfail_id, causing the process to crash. Affected Scenarios: Run an Apache bRPC RTMP server whose RtmpService::NewStream() may return null (i.e., the service rejects createStream requests). A remote client that sends a createStream command and then closes the connection before the rejection response is written can crash the server. How to Fix: (Choose one of the following options) 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3508
Title Apache bRPC: NULL Pointer Dereference in RTMP createStream Error Path Leading to Remote Denial of Service
Weaknesses CWE-476
References

Subscriptions

Apache Brpc
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-26T13:55:45.295Z

Reserved: 2026-08-31T12:26:37.190Z

Link: CVE-2026-82953

cve-icon Vulnrichment

Updated: 2026-10-26T13:55:40.559Z

cve-icon NVD

Status : Deferred

Published: 2026-10-21T13:20:03.560

Modified: 2026-10-26T21:10:00.170

Link: CVE-2026-82953

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-26T16:15:14Z

Weaknesses