CVE-2026-54427 Details
Description
Uncontrolled recursion in the AMF parser in Apache bRPC < 1.18.0 allows a remote RTMP peer to crash a bRPC process by sending deeply nested AMF objects or arrays. The parser recursively processed nested AMF containers without enforcing a depth limit, which could exhaust the native stack. Affected Scenarios: Applications using bRPC RTMP support and parsing AMF data from an untrusted RTMP peer. This includes RTMP servers parsing client command messages, RTMP clients parsing server responses or status messages, and either side parsing inbound AMF script data such as metadata or cue points. Direct callers of ReadAMFObject or ReadAMFArray on untrusted input are also affected. How to Fix: 1. Upgrade Apache bRPC to 1.18.0. 2. Apply the patch from PR https://github.com/apache/brpc/pull/3344 . Note: The fix introduces a configurable AMF nesting depth limit with default value 128. AMF objects or arrays deeper than amf_max_depth are rejected after applying the fix.
A stack exhaustion vulnerability has been identified in the AMF parser of Apache bRPC versions prior to 1.18.0. This vulnerability allows a remote RTMP peer to crash a bRPC process by sending deeply nested AMF objects or arrays. The parser processes these nested containers recursively without enforcing a depth limit, which can exhaust the native stack. This issue affects applications using bRPC RTMP support that parse AMF data from untrusted RTMP peers, including RTMP servers handling client command messages and RTMP clients processing server responses or AMF script data. Direct calls to ReadAMFObject or ReadAMFArray with untrusted input are also impacted.
Users are advised to upgrade Apache bRPC to version 1.18.0 or later. After upgrading, the vulnerability can be further addressed by applying the patch available in PR #3344, which introduces a configurable AMF nesting depth limit, rejecting AMF objects or arrays that exceed the default limit of 128 levels.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 21, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb | [email protected] | AdvisoryBundleMailing ListRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-674 | Uncontrolled Recursion | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Apache bRPC | < 1.18.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | CVE Translated | [email protected] |
| Oct 21, 2026 | New CVE Received | [email protected] |