CVE-2026-56387

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-56387", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-06-21T04:46:23.974Z", "datePublished": "2026-10-21T11:39:11.225Z", "dateUpdated": "2026-10-30T13:56:20.160Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-10-21T11:39:11.225Z"}, "title": "Apache bRPC: Remote Memory Exhaustion in RTMP AMF Parser", "problemTypes": [{"descriptions": [{"description": "CWE-789 Memory Allocation with Excessive Size Value", "lang": "en", "cweId": "CWE-789", "type": "CWE"}, {"description": "CWE-770 Allocation of Resources Without Limits or Throttling", "lang": "en", "cweId": "CWE-770", "type": "CWE"}]}], "source": {"discovery": "EXTERNAL"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache bRPC", "packageURL": "pkg:github/apache/brpc", "versions": [{"status": "affected", "version": "0", "lessThan": "1.18.0", "versionType": "semver"}], "defaultStatus": "unaffected", "collectionURL": "https://github.com", "packageName": "apache/brpc"}], "descriptions": [{"value": "The RTMP AMF parser in Apache bRPC accepts AMF string lengths and array counts directly from untrusted input. A remote unauthenticated attacker who can reach a bRPC server with RTMP enabled can send a small AMF payload with an excessive declared long string length or array count, causing excessive memory allocation or resource consumption before the parser rejects the incomplete payload.\n\nRoot Cause:\nThe AMF long string parser resized the destination string to the declared 32-bit length before validating that the stream contained that many bytes. ECMA array and strict array parsers also accepted 32-bit element counts without a configurable upper bound.\n\nAffected Scenarios:\nDeployments that enable the bRPC RTMP server component and accept RTMP traffic from untrusted clients. Direct uses of the AMF parser on untrusted data are also affected.\n\nHow to Fix:\n1. Upgrade bRPC to version 1.18.0, which fixes this issue.\n2. Apply this patch:\u00a0 https://github.com/apache/brpc/pull/3353 \n\nNote:\nThe fix introduces configurable AMF parsing limits. The default maximum string size is 64 MiB and the default maximum array element count is 1,048,576. Payloads above these limits are rejected. The limits can be adjusted with amf_max_string_size and amf_max_array_size.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "The RTMP AMF parser in Apache bRPC accepts AMF string lengths and array counts directly from untrusted input. A remote unauthenticated attacker who can reach a bRPC server with RTMP enabled can send a small AMF payload with an excessive declared long string length or array count, causing excessive memory allocation or resource consumption before the parser rejects the incomplete payload.<br><br>Root Cause:<br>The AMF long string parser resized the destination string to the declared 32-bit length before validating that the stream contained that many bytes. ECMA array and strict array parsers also accepted 32-bit element counts without a configurable upper bound.<br><br>Affected Scenarios:<br>Deployments that enable the bRPC RTMP server component and accept RTMP traffic from untrusted clients. Direct uses of the AMF parser on untrusted data are also affected.<br><br>How to Fix:<br>1. Upgrade bRPC to version 1.18.0, which fixes this issue.<br>2. Apply this patch:&nbsp;<a target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/apache/brpc/pull/3353\">https://github.com/apache/brpc/pull/3353</a><br><br>Note:<br>The fix introduces configurable AMF parsing limits. The default maximum string size is 64 MiB and the default maximum array element count is 1,048,576. Payloads above these limits are rejected. The limits can be adjusted with amf_max_string_size and amf_max_array_size."}]}], "references": [{"url": "https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "high"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "Nikko Enggaliano Pratama", "type": "finder"}, {"lang": "en", "value": "73Lab of Qingteng.cn", "type": "finder"}], "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-10-30T13:56:07.886655Z", "id": "CVE-2026-56387", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T13:56:20.160Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-56387", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-06-21T04:46:23.974Z", "datePublished": "2026-10-21T11:39:11.225Z", "dateUpdated": "2026-10-30T13:56:20.160Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-10-21T11:39:11.225Z"}, "title": "Apache bRPC: Remote Memory Exhaustion in RTMP AMF Parser", "problemTypes": [{"descriptions": [{"description": "CWE-789 Memory Allocation with Excessive Size Value", "lang": "en", "cweId": "CWE-789", "type": "CWE"}, {"description": "CWE-770 Allocation of Resources Without Limits or Throttling", "lang": "en", "cweId": "CWE-770", "type": "CWE"}]}], "source": {"discovery": "EXTERNAL"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache bRPC", "packageURL": "pkg:github/apache/brpc", "versions": [{"status": "affected", "version": "0", "lessThan": "1.18.0", "versionType": "semver"}], "defaultStatus": "unaffected", "collectionURL": "https://github.com", "packageName": "apache/brpc"}], "descriptions": [{"value": "The RTMP AMF parser in Apache bRPC accepts AMF string lengths and array counts directly from untrusted input. A remote unauthenticated attacker who can reach a bRPC server with RTMP enabled can send a small AMF payload with an excessive declared long string length or array count, causing excessive memory allocation or resource consumption before the parser rejects the incomplete payload.\n\nRoot Cause:\nThe AMF long string parser resized the destination string to the declared 32-bit length before validating that the stream contained that many bytes. ECMA array and strict array parsers also accepted 32-bit element counts without a configurable upper bound.\n\nAffected Scenarios:\nDeployments that enable the bRPC RTMP server component and accept RTMP traffic from untrusted clients. Direct uses of the AMF parser on untrusted data are also affected.\n\nHow to Fix:\n1. Upgrade bRPC to version 1.18.0, which fixes this issue.\n2. Apply this patch:\u00a0 https://github.com/apache/brpc/pull/3353 \n\nNote:\nThe fix introduces configurable AMF parsing limits. The default maximum string size is 64 MiB and the default maximum array element count is 1,048,576. Payloads above these limits are rejected. The limits can be adjusted with amf_max_string_size and amf_max_array_size.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "The RTMP AMF parser in Apache bRPC accepts AMF string lengths and array counts directly from untrusted input. A remote unauthenticated attacker who can reach a bRPC server with RTMP enabled can send a small AMF payload with an excessive declared long string length or array count, causing excessive memory allocation or resource consumption before the parser rejects the incomplete payload.<br><br>Root Cause:<br>The AMF long string parser resized the destination string to the declared 32-bit length before validating that the stream contained that many bytes. ECMA array and strict array parsers also accepted 32-bit element counts without a configurable upper bound.<br><br>Affected Scenarios:<br>Deployments that enable the bRPC RTMP server component and accept RTMP traffic from untrusted clients. Direct uses of the AMF parser on untrusted data are also affected.<br><br>How to Fix:<br>1. Upgrade bRPC to version 1.18.0, which fixes this issue.<br>2. Apply this patch:&nbsp;<a target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/apache/brpc/pull/3353\">https://github.com/apache/brpc/pull/3353</a><br><br>Note:<br>The fix introduces configurable AMF parsing limits. The default maximum string size is 64 MiB and the default maximum array element count is 1,048,576. Payloads above these limits are rejected. The limits can be adjusted with amf_max_string_size and amf_max_array_size."}]}], "references": [{"url": "https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "high"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "Nikko Enggaliano Pratama", "type": "finder"}, {"lang": "en", "value": "73Lab of Qingteng.cn", "type": "finder"}], "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-56387", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-30T13:56:07.886655Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T13:55:48.735Z"}}]}}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com", "defaultStatus": "unaffected", "packageName": "apache/brpc", "packageURL": "pkg:github/apache/brpc", "product": "Apache bRPC", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "1.18.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@apache.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The RTMP AMF parser in Apache bRPC accepts AMF string lengths and array counts directly from untrusted input. A remote unauthenticated attacker who can reach a bRPC server with RTMP enabled can send a small AMF payload with an excessive declared long string length or array count, causing excessive memory allocation or resource consumption before the parser rejects the incomplete payload.\n\nRoot Cause:\nThe AMF long string parser resized the destination string to the declared 32-bit length before validating that the stream contained that many bytes. ECMA array and strict array parsers also accepted 32-bit element counts without a configurable upper bound.\n\nAffected Scenarios:\nDeployments that enable the bRPC RTMP server component and accept RTMP traffic from untrusted clients. Direct uses of the AMF parser on untrusted data are also affected.\n\nHow to Fix:\n1. Upgrade bRPC to version 1.18.0, which fixes this issue.\n2. Apply this patch:\u00a0 https://github.com/apache/brpc/pull/3353 \n\nNote:\nThe fix introduces configurable AMF parsing limits. The default maximum string size is 64 MiB and the default maximum array element count is 1,048,576. Payloads above these limits are rejected. The limits can be adjusted with amf_max_string_size and amf_max_array_size."}, {"lang": "es", "value": "El analizador AMF de RTMP en Apache bRPC acepta longitudes de cadenas AMF y recuentos de matrices directamente de entrada no confiable. Un atacante remoto no autenticado que pueda alcanzar un servidor bRPC con RTMP habilitado puede enviar una peque\u00f1a carga \u00fatil AMF con una longitud de cadena declarada excesiva o un recuento de matriz excesivo, provocando una asignaci\u00f3n excesiva de memoria o un consumo de recursos antes de que el analizador rechace la carga \u00fatil incompleta.\\n\\nCausa ra\u00edz:\\nEl analizador de cadenas largas AMF redimension\u00f3 la cadena de destino al tama\u00f1o de 32?bits declarado antes de validar que el flujo contuviera esa cantidad de bytes. Los analizadores de matrices ECMA y de matrices estrictas tambi\u00e9n aceptaban recuentos de elementos de 32?bits sin un l\u00edmite superior configurable.\\n\\nEscenarios afectados:\\nImplementaciones que habilitan el componente de servidor bRPC RTMP y aceptan tr\u00e1fico RTMP de clientes no confiables. El uso directo del analizador AMF sobre datos no confiables tambi\u00e9n se ve afectado.\\n\\nC\u00f3mo solucionar:\\n1. Actualice bRPC a la versi\u00f3n 1.18.0, que corrige este problema. \\n2. Aplique este parche: https://github.com/apache/brpc/pull/3353\\n\\nNota:\\nLa correcci\u00f3n introduce l\u00edmites configurables para el an\u00e1lisis AMF. El tama\u00f1o m\u00e1ximo de cadena predeterminado es 64?MiB y el recuento m\u00e1ximo de elementos de matriz predeterminado es 1?048?576. Las cargas \u00fatiles que superen estos l\u00edmites son rechazadas. Los l\u00edmites pueden ajustarse con?amf_max_string_size y?amf_max_array_size."}], "id": "CVE-2026-56387", "lastModified": "2026-10-30T14:17:06.473", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-56387", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-30T13:56:07.886655Z", "version": "2.0.3"}}]}, "published": "2026-10-21T12:17:21.547", "references": [{"source": "security@apache.org", "url": "https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}, {"lang": "en", "value": "CWE-789"}], "source": "security@apache.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.18.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Apache bRPC", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "brpc", "vendor": "apache"}], "created": "2026-10-21T19:30:08.107721+00:00", "updated": "2026-10-30T16:30:16.136077+00:00", "vendors": ["apache", "apache$PRODUCT$brpc"]}