CVE-2026-84727

{
  "id": "CVE-2026-84727",
  "sourceIdentifier": "[email protected]",
  "published": "2026-10-21T13:20:03.697",
  "lastModified": "2026-10-26T20:10:00.160",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Use-after-free in the RTMP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows a malicious RTMP peer to crash the process or potentially corrupt memory via a crafted Abort message.\n\nRoot Cause:\nWhen processing an RTMP Abort (protocol control message type 2), the RTMP policy implementation deleted the target RtmpChunkStream object. The send path (RtmpUnsentMessage::AppendAndDestroySelf -> RtmpChunkStream::SerializeMessage) runs concurrently on sender threads and dereferences the same RtmpChunkStream object without synchronization. If a remote peer sends an Abort message naming a chunk stream that is concurrently being used to serialize an outgoing message, the stream object is freed while still in use, resulting in a use-after-free. Additionally, deleting the chunk stream discarded its previous message header, so subsequent compressed (type-3) chunk headers on that stream could no longer be decoded.\n\nAffected Scenarios:\nAny application using the bRPC RTMP protocol implementation (rtmp policy), either as an RTMP server or as an RTMP client, where the remote endpoint is untrusted. The attacker needs to send an Abort message targeting a chunk stream id that is concurrently used for sending, which can crash the process or lead to memory corruption.\n\nHow to Fix:\n(Choose one of the following options)\n1. Upgrade bRPC to version 1.18.0, which fixes this issue.\n2. Apply this patch:  https://github.com/apache/brpc/pull/3515"
    },
    {
      "lang": "es",
      "value": "Uso después de liberación en la implementación del protocolo RTMP en Apache bRPC (versiones anteriores a la 1.18.0) en todas las plataformas permite a un peer RTMP malicioso bloquear el proceso o potencialmente provocar corrupción de memoria mediante un mensaje Abort manipulado.\\n\\nCausa raíz:  \\nAl procesar un Abort RTMP (mensaje de control del protocolo tipo 2), la implementación de la política RTMP eliminó el objeto RtmpChunkStream de destino. La ruta de envío (RtmpUnsentMessage::AppendAndDestroySelf    ->    RtmpChunkStream::SerializeMessage) se ejecuta concurrentemente en hilos de envío y desreferencia el mismo objeto RtmpChunkStream sin sincronización. Si un peer remoto envía un mensaje Abort que nombra un chunk stream que está siendo usado simultáneamente para serializar un mensaje saliente, el objeto del stream se libera mientras aún está en uso, lo que produce un uso después de liberación. Además, al eliminar el chunk stream se descarta su encabezado de mensaje previo, de modo que los encabezados de chunk comprimidos (tipo?3) posteriores en ese stream ya no pueden decodificarse.\\n\\nEscenarios afectados:  \\nCualquier aplicación que utilice la implementación del protocolo RTMP de bRPC (política rtmp), ya sea como servidor RTMP o como cliente RTMP, donde el endpoint remoto no sea de confianza. El atacante necesita enviar un mensaje Abort que apunte a un identificador de chunk stream que se esté usando concurrentemente para el envío, lo que puede bloquear el proceso o provocar corrupción de memoria.\\n\\nCómo corregir:  \\n(Elija una de las siguientes opciones)  \\n1. Actualizar bRPC a la versión 1.18.0, que corrige este problema.  \\n2. Aplicar este parche: https://github.com/apache/brpc/pull/3515"
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache bRPC",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com",
          "packageName": "apache/brpc",
          "packageURL": "pkg:github/apache/brpc",
          "versions": [
            {
              "version": "0",
              "lessThan": "1.18.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-10-21T13:17:59.329850Z",
          "id": "CVE-2026-84727",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/apache/brpc/pull/3515",
      "source": "[email protected]"
    },
    {
      "url": "https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb",
      "source": "[email protected]"
    }
  ]
}