CVE-2026-56387

{
  "id": "CVE-2026-56387",
  "sourceIdentifier": "[email protected]",
  "published": "2026-10-21T12:17:21.547",
  "lastModified": "2026-10-30T14:17:06.473",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The RTMP AMF parser in Apache bRPC accepts AMF string lengths and array counts directly from untrusted input. A remote unauthenticated attacker who can reach a bRPC server with RTMP enabled can send a small AMF payload with an excessive declared long string length or array count, causing excessive memory allocation or resource consumption before the parser rejects the incomplete payload.\n\nRoot Cause:\nThe AMF long string parser resized the destination string to the declared 32-bit length before validating that the stream contained that many bytes. ECMA array and strict array parsers also accepted 32-bit element counts without a configurable upper bound.\n\nAffected Scenarios:\nDeployments that enable the bRPC RTMP server component and accept RTMP traffic from untrusted clients. Direct uses of the AMF parser on untrusted data are also affected.\n\nHow to Fix:\n1. Upgrade bRPC to version 1.18.0, which fixes this issue.\n2. Apply this patch:  https://github.com/apache/brpc/pull/3353 \n\nNote:\nThe fix introduces configurable AMF parsing limits. The default maximum string size is 64 MiB and the default maximum array element count is 1,048,576. Payloads above these limits are rejected. The limits can be adjusted with amf_max_string_size and amf_max_array_size."
    },
    {
      "lang": "es",
      "value": "El analizador AMF de RTMP en Apache bRPC acepta longitudes de cadenas AMF y recuentos de matrices directamente de entrada no confiable. Un atacante remoto no autenticado que pueda alcanzar un servidor bRPC con RTMP habilitado puede enviar una pequeña carga útil AMF con una longitud de cadena declarada excesiva o un recuento de matriz excesivo, provocando una asignación excesiva de memoria o un consumo de recursos antes de que el analizador rechace la carga útil incompleta.\\n\\nCausa raíz:\\nEl analizador de cadenas largas AMF redimensionó la cadena de destino al tamaño de 32?bits declarado antes de validar que el flujo contuviera esa cantidad de bytes. Los analizadores de matrices ECMA y de matrices estrictas también aceptaban recuentos de elementos de 32?bits sin un límite superior configurable.\\n\\nEscenarios afectados:\\nImplementaciones que habilitan el componente de servidor bRPC RTMP y aceptan tráfico RTMP de clientes no confiables. El uso directo del analizador AMF sobre datos no confiables también se ve afectado.\\n\\nCómo solucionar:\\n1. Actualice bRPC a la versión 1.18.0, que corrige este problema.  \\n2. Aplique este parche: https://github.com/apache/brpc/pull/3353\\n\\nNota:\\nLa corrección introduce límites configurables para el análisis AMF. El tamaño máximo de cadena predeterminado es 64?MiB y el recuento máximo de elementos de matriz predeterminado es 1?048?576. Las cargas útiles que superen estos límites son rechazadas. Los límites pueden ajustarse con?amf_max_string_size y?amf_max_array_size."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache bRPC",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com",
          "packageName": "apache/brpc",
          "packageURL": "pkg:github/apache/brpc",
          "versions": [
            {
              "version": "0",
              "lessThan": "1.18.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-10-30T13:56:07.886655Z",
          "id": "CVE-2026-56387",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        },
        {
          "lang": "en",
          "value": "CWE-789"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb",
      "source": "[email protected]"
    }
  ]
}