CVE-2026-74758

Deferred Deferred - Pending Action

Heap Use-After-Free in Apache bRPC RTMP Protocol

Publication date: 2026-10-21

Last updated on: 2026-10-30

Assigner: Apache Software Foundation

Description

A heap use-after-free in the RTMP protocol component of Apache bRPC (versions < 1.18.0) allows a remote attacker to crash a bRPC RTMP server by sending a crafted Abort control message. No authentication or application-level request is required. Root Cause: When an RTMP Abort control message names the chunk stream that is currently being parsed (the chunk stream carrying the message itself), RtmpChunkStream::OnAbortMessage calls RtmpContext::ClearChunkStream, which deletes the RtmpChunkStream while its Feed() is still running. After the message handler returns, Feed() continues to access members of the deleted object, resulting in a heap-use-after-free. Affected Scenarios: bRPC servers that enable RTMP support (ServerOptions.rtmp_service set) and accept connections from untrusted networks. How to Fix: 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3452 The fix skips clearing the chunk stream when the Abort message targets the chunk stream that is currently being parsed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-30

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-74758

EUVD

EUVD-2026-107182

Affected Vendors & Products

Vendor	Product	Version / Range
Apache Software Foundation	Apache bRPC	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This is a heap use-after-free vulnerability in Apache bRPC's RTMP protocol component affecting versions before 1.18.0. It occurs when a crafted Abort control message targets the chunk stream currently being processed, causing the server to delete an object while it is still in use. This leads to memory corruption when the program later accesses the freed memory.

Detection Guidance

Detecting this vulnerability requires monitoring for crashes or abnormal behavior in bRPC RTMP servers. Check server logs for segmentation faults or heap corruption errors after receiving RTMP Abort control messages. Use tools like gdb to analyze core dumps if crashes occur. Monitor network traffic for malformed RTMP Abort messages targeting active chunk streams.

Impact Analysis

An attacker could exploit this to crash bRPC RTMP servers, causing denial-of-service. Since no authentication is required, any untrusted network connection could trigger this issue if the server has RTMP support enabled.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a technical flaw in Apache bRPC's RTMP protocol handling. However, if exploited, it could lead to server crashes or potential data exposure, which may indirectly impact compliance by disrupting secure data processing or availability requirements.

Mitigation Strategies

Immediately upgrade bRPC to version 1.18.0 or apply the patch from https://github.com/apache/brpc/pull/3452. Disable RTMP support if not required by setting ServerOptions.rtmp_service to false. Restrict network access to bRPC servers to trusted sources only.

Hi! I’m here to help you understand CVE-2026-74758. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...