CVE-2026-54427 in bRPC
Summary
by MITRE • 10/21/2026
Uncontrolled recursion in the AMF parser in Apache bRPC < 1.18.0 allows a remote RTMP peer to crash a bRPC process by sending deeply nested AMF objects or arrays. The parser recursively processed nested AMF containers without enforcing a depth limit, which could exhaust the native stack.
Affected Scenarios: Applications using bRPC RTMP support and parsing AMF data from an untrusted RTMP peer. This includes RTMP servers parsing client command messages, RTMP clients parsing server responses or status messages, and either side parsing inbound AMF script data such as metadata or cue points. Direct callers of ReadAMFObject or ReadAMFArray on untrusted input are also affected.
How to Fix: 1. Upgrade Apache bRPC to 1.18.0. 2. Apply the patch from PR https://github.com/apache/brpc/pull/3344 .
Note: The fix introduces a configurable AMF nesting depth limit with default value 128. AMF objects or arrays deeper than amf_max_depth are rejected after applying the fix.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified in Apache bRPC versions prior to 1.18.0 represents a critical uncontrolled recursion flaw within the Action Message Format parser, specifically impacting components that handle Real-Time Messaging Protocol traffic. This issue allows an attacker who can communicate with the affected service over RTMP to trigger a denial of service condition by sending deeply nested AMF objects or arrays. The core technical deficiency lies in the recursive processing logic used to parse these data structures. When the parser encounters nested containers, it invokes itself recursively for each level of nesting without implementing any mechanism to track or limit the depth of this recursion. Consequently, an adversary can craft a malicious payload consisting of excessively deep AMF structures that force the application to consume stack space at an unsustainable rate until the native call stack is exhausted, resulting in a process crash and service interruption.
This vulnerability falls under the category of CWE-675, which describes operations with uncontrolled number of repetitions or recursion depth. In the context of the MITRE ATT&CK framework, this behavior aligns with techniques associated with resource exhaustion attacks, where an attacker manipulates input to consume system resources such as memory or processing time, thereby degrading availability for legitimate users. The operational impact is severe because it directly compromises the stability and reliability of services relying on bRPC for RTMP communication. Any application that parses AMF data from untrusted sources is at risk, including RTMP servers handling client command messages, RTMP clients interpreting server responses or status updates, and systems processing inbound script data such as metadata or cue points. Furthermore, direct callers of the ReadAMFObject or ReadAMFArray functions when provided with external input are equally susceptible to this exploitation vector.
To mitigate this vulnerability, organizations must ensure that their infrastructure is updated to Apache bRPC version 1.18.0 or later. This release incorporates a definitive fix by introducing a configurable limit on AMF nesting depth, set to a default value of one hundred twenty-eight levels deep. With this patch applied, the parser will actively reject any AMF objects or arrays that exceed the specified maximum depth threshold before they can cause stack overflow conditions. Alternatively, if an immediate upgrade is not feasible, administrators should apply the specific patch provided in pull request number 3344 on the Apache bRPC GitHub repository to restore secure parsing behavior and prevent remote attackers from exploiting this recursion flaw.