CVE-2026-54427

{
  "id": "CVE-2026-54427",
  "sourceIdentifier": "[email protected]",
  "published": "2026-10-21T12:17:21.290",
  "lastModified": "2026-10-30T14:17:06.303",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Uncontrolled recursion in the AMF parser in Apache bRPC < 1.18.0 allows a remote RTMP peer to crash a bRPC process by sending deeply nested AMF objects or arrays. The parser recursively processed nested AMF containers without enforcing a depth limit, which could exhaust the native stack.\n\nAffected Scenarios:\nApplications using bRPC RTMP support and parsing AMF data from an untrusted RTMP peer. This includes RTMP servers parsing client command messages, RTMP clients parsing server responses or status messages, and either side parsing inbound AMF script data such as metadata or cue points. Direct callers of ReadAMFObject or ReadAMFArray on untrusted input are also affected.\n\nHow to Fix:\n1. Upgrade Apache bRPC to 1.18.0.\n2. Apply the patch from PR  https://github.com/apache/brpc/pull/3344 .\n\nNote:\nThe fix introduces a configurable AMF nesting depth limit with default value 128. AMF objects or arrays deeper than amf_max_depth are rejected after applying the fix."
    },
    {
      "lang": "es",
      "value": "Recursión no controlada en el analizador AMF de Apache bRPC versiones anteriores a 1.18.0 permite que un par RTMP remoto provoque la caída de un proceso bRPC enviando objetos o matrices AMF profundamente anidados. El analizador procesaba recursivamente contenedores AMF anidados sin imponer un límite de profundidad, lo que podía agotar la pila nativa.\\n\\nEscenarios afectados:\\nAplicaciones que utilizan el soporte RTMP de bRPC y analizan datos AMF de un par RTMP no confiable. Esto incluye servidores RTMP que analizan mensajes de comando del cliente, clientes RTMP que analizan respuestas o mensajes de estado del servidor, y cualquiera de las partes que analice datos de script AMF entrantes, como metadatos o puntos de referencia. También se ven afectados los llamadores directos de?ReadAMFObject?o?ReadAMFArray?sobre entrada no confiable.\\n\\nCómo solucionar:\\n1. Actualice Apache bRPC a la versión 1.18.0.  \\n2. Aplique el parche del PR https://github.com/apache/brpc/pull/3344.\\n\\nNota:\\nLa corrección introduce un límite configurable de profundidad de anidamiento AMF con un valor predeterminado de 128. Los objetos o matrices AMF con una profundidad mayor que?amf_max_depth?son rechazados después de aplicar la corrección."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache bRPC",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com",
          "packageName": "apache/brpc",
          "packageURL": "pkg:github/apache/brpc",
          "versions": [
            {
              "version": "0",
              "lessThan": "1.18.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-10-30T13:52:32.038030Z",
          "id": "CVE-2026-54427",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-674"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb",
      "source": "[email protected]"
    }
  ]
}