Description
NULL pointer dereference in the RTMP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to crash the server (denial of service) via a crafted createStream command.

Root Cause:
When an RTMP service rejects a createStream request by returning a null stream from RtmpService::NewStream(), the server sends an error response to the client. If writing this rejection response fails (for example, because the client closes the connection immediately after sending the createStream command), the error-handling path in RtmpChunkStream::OnCreateStream() dereferences the null stream pointer to access stream->_onfail_id, causing the process to crash.

Affected Scenarios:
Run an Apache bRPC RTMP server whose RtmpService::NewStream() may return null (i.e., the service rejects createStream requests). A remote client that sends a createStream command and then closes the connection before the rejection response is written can crash the server.

How to Fix:
(Choose one of the following options)
1. Upgrade bRPC to version 1.18.0, which fixes this issue.
2. Apply this patch: https://github.com/apache/brpc/pull/3508
Published: 2026-10-21
Score: n/a
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

A null pointer dereference is introduced in the error handling of the RTMP createStream command. When a client sends a createStream request that is rejected and immediately closes the connection, the server’s error path dereferences a null stream pointer to access stream->_onfail_id, causing the bRPC process to crash. The result is a denial‑of‑service that can be triggered remotely over the RTMP protocol. This flaw is a classic instance of CWE-476.

Affected Systems

All deployments of Apache bRPC running any version older than 1.18.0 on any supported operating system. The vulnerability resides in the RTMP protocol implementation and applies to any environment that exposes an RTMP endpoint.

Risk and Exploitability

The CVSS score is not defined in the publicly available data, and EPSS information is currently unavailable. Nevertheless, the vulnerability allows an attacker with network access to the RTMP port to trigger an unrecoverable crash without requiring elevated privileges. The lack of a KEV listing does not diminish the urgency; a server that remains online can be repeatedly exploited. Therefore, the risk for unpatched installations remains high, and the fallout can be widespread if the service is critical.

Generated by OpenCVE AI on October 21, 2026 at 18:22 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Apache bRPC to version 1.18.0, which contains the corrective patch.
  • If an upgrade cannot be performed immediately, apply the patch from pull request 3508 to close the null‑pointer dereference path.
  • Limit access to the RTMP endpoint or disable it entirely while remediation is pending to prevent exploitation of the flaw.

Generated by OpenCVE AI on October 21, 2026 at 18:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Description NULL pointer dereference in the RTMP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to crash the server (denial of service) via a crafted createStream command. Root Cause: When an RTMP service rejects a createStream request by returning a null stream from RtmpService::NewStream(), the server sends an error response to the client. If writing this rejection response fails (for example, because the client closes the connection immediately after sending the createStream command), the error-handling path in RtmpChunkStream::OnCreateStream() dereferences the null stream pointer to access stream->_onfail_id, causing the process to crash. Affected Scenarios: Run an Apache bRPC RTMP server whose RtmpService::NewStream() may return null (i.e., the service rejects createStream requests). A remote client that sends a createStream command and then closes the connection before the rejection response is written can crash the server. How to Fix: (Choose one of the following options) 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3508
Title Apache bRPC: NULL Pointer Dereference in RTMP createStream Error Path Leading to Remote Denial of Service
Weaknesses CWE-476
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-21T12:10:07.391Z

Reserved: 2026-08-31T12:26:37.190Z

Link: CVE-2026-82953

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-21T13:20:03.560

Modified: 2026-10-21T13:20:03.560

Link: CVE-2026-82953

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T18:30:14Z

Weaknesses