CVE-2026-82953

Deferred Deferred - Pending Action

NULL Pointer Dereference in Apache bRPC RTMP Protocol

Publication date: 2026-10-21

Last updated on: 2026-10-26

Assigner: Apache Software Foundation

Description

NULL pointer dereference in the RTMP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to crash the server (denial of service) via a crafted createStream command. Root Cause: When an RTMP service rejects a createStream request by returning a null stream from RtmpService::NewStream(), the server sends an error response to the client. If writing this rejection response fails (for example, because the client closes the connection immediately after sending the createStream command), the error-handling path in RtmpChunkStream::OnCreateStream() dereferences the null stream pointer to access stream->_onfail_id, causing the process to crash. Affected Scenarios: Run an Apache bRPC RTMP server whose RtmpService::NewStream() may return null (i.e., the service rejects createStream requests). A remote client that sends a createStream command and then closes the connection before the rejection response is written can crash the server. How to Fix: (Choose one of the following options) 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3508

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-26

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-82953

EUVD

EUVD-2026-107221

Affected Vendors & Products

Vendor	Product	Version / Range
Apache Software Foundation	Apache bRPC	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This vulnerability is a NULL pointer dereference in Apache bRPC's RTMP protocol implementation. It occurs when a server rejects a createStream request by returning a null stream. If the server fails to write the rejection response (e.g., due to the client closing the connection), the error-handling code incorrectly tries to access the null stream pointer, causing the server to crash.

Detection Guidance

To detect this vulnerability, monitor your Apache bRPC RTMP server for crashes when processing createStream commands. Check server logs for segmentation faults or null pointer dereference errors during RTMP protocol handling. Use network traffic analysis tools like Wireshark to inspect RTMP packets for malformed createStream commands followed by abrupt connection closures.

Impact Analysis

If you run an Apache bRPC RTMP server with a version older than 1.18.0, a remote attacker could send a crafted createStream command and then close the connection. This would crash your server, leading to a denial of service where legitimate users cannot access the service.

Compliance Impact

This vulnerability causes a denial of service by crashing the RTMP server, which could disrupt data processing or communication systems. For GDPR, this may impact availability of personal data processing. For HIPAA, it could interrupt systems handling protected health information. Downtime risks non-compliance with availability requirements.

Mitigation Strategies

Upgrade Apache bRPC to version 1.18.0 or later to address the vulnerability.
Apply the patch from https://github.com/apache/brpc/pull/3508 if upgrading is not immediately possible.
Restrict network access to the RTMP server to trusted clients only until patched.
Monitor server logs for crashes or unusual RTMP protocol errors as potential exploitation attempts.

Hi! I’m here to help you understand CVE-2026-82953. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...