CVE-2026-56387: Apache bRPC: Remote Memory Exhaustion in RTMP AMF Parser
The RTMP AMF parser in Apache bRPC accepts AMF string lengths and array counts directly from untrusted input. A remote unauthenticated attacker who can reach a bRPC server with RTMP enabled can send a small AMF payload with an excessive declared long string length or array count, causing excessive memory allocation or resource consumption before the parser rejects the incomplete payload.
Root Cause: The AMF long string parser resized the destination string to the declared 32-bit length before validating that the stream contained that many bytes. ECMA array and strict array parsers also accepted 32-bit element counts without a configurable upper bound.
Affected Scenarios: Deployments that enable the bRPC RTMP server component and accept RTMP traffic from untrusted clients. Direct uses of the AMF parser on untrusted data are also affected.
How to Fix: 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3353
Note: The fix introduces configurable AMF parsing limits. The default maximum string size is 64 MiB and the default maximum array element count is 1,048,576. Payloads above these limits are rejected. The limits can be adjusted with amfmaxstringsize and amfmaxarraysize.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache bRPCto a version that resolves this vulnerability.Fixed in 1.18.0 - Configuration
Configure the maximum AMF string size; the default limit is 64 MiB, and payloads above the limit are rejected.
Apache bRPC AMF parser amf_max_string_size = 64 MiB - Configuration
Configure the maximum AMF array element count; the default limit is 1,048,576, and payloads above the limit are rejected.
Apache bRPC AMF parser amf_max_array_size = 1,048,576
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments with the bRPC RTMP server component enabled that accept RTMP traffic from untrusted clients are affected. Applications that directly use the AMF parser on untrusted data are also affected.
What does an attacker need to exploit it?
An attacker must be able to reach a bRPC server with RTMP enabled, or otherwise supply untrusted data to a direct AMF parser use. No authentication is required, and a small AMF payload can declare excessive string lengths or array counts.
Are protections enabled by default after applying the fix?
Yes. The fix adds configurable AMF parsing limits with a default maximum string size of 64 MiB and a default maximum array element count of 1,048,576; payloads exceeding those limits are rejected.
What can be done if an immediate upgrade is not possible?
Apply the referenced patch. Until then, restrict RTMP access from untrusted clients and avoid passing untrusted data to direct AMF parser uses where possible.