CVE-2026-74758 in bRPC
Summary
by MITRE • 10/22/2026
A heap use-after-free in the RTMP protocol component of Apache bRPC (versions < 1.18.0) allows a remote attacker to crash a bRPC RTMP server by sending a crafted Abort control message. No authentication or application-level request is required.
Root Cause: When an RTMP Abort control message names the chunk stream that is currently being parsed (the chunk stream carrying the message itself), RtmpChunkStream::OnAbortMessage calls RtmpContext::ClearChunkStream, which deletes the RtmpChunkStream while its Feed() is still running. After the message handler returns, Feed() continues to access members of the deleted object, resulting in a heap-use-after-free.
Affected Scenarios: bRPC servers that enable RTMP support (ServerOptions.rtmp_service set) and accept connections from untrusted networks.
How to Fix: 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3452
The fix skips clearing the chunk stream when the Abort message targets the chunk stream that is currently being parsed.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
A critical heap use-after-free vulnerability has been identified within the Real-Time Messaging Protocol implementation of Apache bRPC, specifically affecting versions prior to 1.18.0. This flaw resides in the RTMP protocol component and allows a remote attacker to cause a denial of service by crashing the server process without requiring any form of authentication or application-level request. The vulnerability is triggered when an untrusted client sends a specially crafted Abort control message that targets the specific chunk stream currently being parsed by the server. This scenario highlights a significant gap in input validation and lifecycle management within the protocol handler, exposing servers that have RTMP support enabled via ServerOptions.rtmp_service to immediate risk if they accept connections from untrusted networks.
The root cause of this vulnerability lies in a race condition-like logic error during message processing. When an Abort control message specifies the chunk stream carrying the current message, the function RtmpChunkStream::OnAbortMessage invokes RtmpContext::ClearChunkStream. This call results in the immediate deletion of the RtmpChunkStream object while its Feed() method is still actively executing and holding references to that same object. Once the message handler returns control to the calling context, the Feed() method continues execution and attempts to access members of the now-deleted heap memory. Because the memory has been freed but not nullified or protected from further access, this results in a classic use-after-free condition. Depending on the allocator state and timing, this can lead to immediate application crashes, data corruption, or potentially more severe exploitation vectors if an attacker can control the contents of the reclaimed memory region.
From a security classification perspective, this vulnerability aligns with CWE-416, which describes Use After Free errors where software continues to use pointers that point to freed memory. The operational impact is primarily a denial of service against RTMP services hosted on bRPC servers. Since no authentication is required, the attack surface is broad and accessible to any network actor capable of reaching the server port. This aligns with MITRE ATT&CK technique T1499, Endpoint Denial of Service, specifically under the sub-technique for resource exhaustion via application layer attacks. The lack of input validation regarding which chunk stream an Abort message targets is a fundamental design flaw that violates secure coding principles regarding object lifecycle management and pointer safety.
To mitigate this vulnerability, organizations running Apache bRPC versions earlier than 1.18.0 must take immediate action. The primary remediation step is to upgrade the bRPC library to version 1.18.0 or later, where the underlying logic has been corrected to prevent premature object deletion during active parsing. For environments that cannot immediately upgrade due to dependency constraints, a manual patch can be applied by referencing pull request #3452 on the Apache GitHub repository for bRPC. This patch modifies the OnAbortMessage handler to skip clearing the chunk stream if it is the same as the one currently being parsed, thereby preserving object integrity until parsing completes naturally. Additionally, administrators should review network access controls and consider restricting RTMP service exposure to trusted internal networks only until patches are fully deployed across all affected instances.