CVE-2026-54427: Apache bRPC: Stack Exhaustion via Unbounded Recursion in AMF Parser
Uncontrolled recursion in the AMF parser in Apache bRPC < 1.18.0 allows a remote RTMP peer to crash a bRPC process by sending deeply nested AMF objects or arrays. The parser recursively processed nested AMF containers without enforcing a depth limit, which could exhaust the native stack.
Affected Scenarios: Applications using bRPC RTMP support and parsing AMF data from an untrusted RTMP peer. This includes RTMP servers parsing client command messages, RTMP clients parsing server responses or status messages, and either side parsing inbound AMF script data such as metadata or cue points. Direct callers of ReadAMFObject or ReadAMFArray on untrusted input are also affected.
How to Fix: 1. Upgrade Apache bRPC to 1.18.0. 2. Apply the patch from PR https://github.com/apache/brpc/pull/3344 .
Note: The fix introduces a configurable AMF nesting depth limit with default value 128. AMF objects or arrays deeper than amfmaxdepth are rejected after applying the fix.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache bRPCto a version that resolves this vulnerability.Fixed in 1.18.0 - Configuration
Configure the AMF nesting depth limit amf_max_depth to 128; AMF objects or arrays deeper than this limit are rejected.
Apache bRPC AMF parser amf_max_depth = 128
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using bRPC RTMP support that parse AMF from untrusted RTMP peers are exposed. This includes RTMP servers processing client command messages, RTMP clients processing server responses or status messages, and either side processing inbound AMF metadata or cue points; direct callers of ReadAMFObject or ReadAMFArray on untrusted input are also affected.
What must an attacker be able to do to trigger the crash?
An attacker must be able to act as an untrusted RTMP peer, or otherwise supply untrusted input to ReadAMFObject or ReadAMFArray. They can send AMF objects or arrays nested deeply enough to exhaust the process's native stack.
Are installations protected by default after upgrading?
Yes. The fix introduces a configurable AMF nesting-depth limit whose default value is 128, and AMF objects or arrays deeper than amf_max_depth are rejected.
What can be done if an immediate upgrade is not possible?
Apply the patch from PR 3344. The provided data does not specify another mitigation.