CVE-2026-56387

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-21

Last updated on: 2026-10-30

Assigner: Apache Software Foundation

Description

The RTMP AMF parser in Apache bRPC accepts AMF string lengths and array counts directly from untrusted input. A remote unauthenticated attacker who can reach a bRPC server with RTMP enabled can send a small AMF payload with an excessive declared long string length or array count, causing excessive memory allocation or resource consumption before the parser rejects the incomplete payload. Root Cause: The AMF long string parser resized the destination string to the declared 32-bit length before validating that the stream contained that many bytes. ECMA array and strict array parsers also accepted 32-bit element counts without a configurable upper bound. Affected Scenarios: Deployments that enable the bRPC RTMP server component and accept RTMP traffic from untrusted clients. Direct uses of the AMF parser on untrusted data are also affected. How to Fix: 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3353 Note: The fix introduces configurable AMF parsing limits. The default maximum string size is 64 MiB and the default maximum array element count is 1,048,576. Payloads above these limits are rejected. The limits can be adjusted with amf_max_string_size and amf_max_array_size.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-30

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-56387

EUVD

EUVD-2026-107173

Affected Vendors & Products

Vendor	Product	Version / Range
Apache Software Foundation	Apache bRPC	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-789	The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability is in Apache bRPC's RTMP AMF parser. It allows a remote unauthenticated attacker to send a specially crafted AMF payload with an excessively large declared string length or array count. The parser allocates memory based on these values before validating the actual data size, leading to resource exhaustion or crashes.

Detection Guidance

Detecting this vulnerability requires monitoring for excessive memory usage or crashes in bRPC RTMP servers. Check for unusual network traffic patterns targeting RTMP ports. Monitor logs for failed AMF parsing attempts or memory allocation errors. No specific commands are provided in the context.

Impact Analysis

If you run a bRPC server with RTMP enabled and accept untrusted RTMP traffic, an attacker could cause denial of service by consuming excessive memory or CPU. Direct use of the AMF parser on untrusted data also poses the same risk.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling denial-of-service attacks that disrupt services handling sensitive data. Excessive memory allocation may lead to system instability, potentially causing unauthorized access or data processing interruptions, which are critical violations under these regulations.

Mitigation Strategies

Upgrade bRPC to version 1.18.0 or apply the patch from https://github.com/apache/brpc/pull/3353.
Disable the bRPC RTMP server component if not required.
Monitor for unusual RTMP traffic and set up alerts for excessive memory usage.

Hi! I’m here to help you understand CVE-2026-56387. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...