CVE-2026-54427

Uncontrolled recursion in the AMF parser in Apache bRPC < 1.18.0 allows a remote RTMP peer to crash a bRPC process by sending deeply nested AMF objects or arrays. The parser recursively processed nested AMF containers without enforcing a depth limit, which could exhaust the native stack. Affected Scenarios: Applications using bRPC RTMP support and parsing AMF data from an untrusted RTMP peer. This includes RTMP servers parsing client command messages, RTMP clients parsing server responses or status messages, and either side parsing inbound AMF script data such as metadata or cue points. Direct callers of ReadAMFObject or ReadAMFArray on untrusted input are also affected. How to Fix: 1. Upgrade Apache bRPC to 1.18.0. 2. Apply the patch from PR https://github.com/apache/brpc/pull/3344 . Note: The fix introduces a configurable AMF nesting depth limit with default value 128. AMF objects or arrays deeper than amf_max_depth are rejected after applying the fix.

• CWE-674

• https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb

Published

Oct 21, 2026

Last Modified

Oct 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54421In OpenStack Ironic before 37.0.1, when applying a PATCH to …6.8
• CVE-2026-54422In OpenStack Ironic Python Agent through 11.5.0, a malicious…5.5
• CVE-2026-54423In OpenStack Ironic before 37.0.1, an Ironic user with the a…8.2
• CVE-2026-54424An Incorrect Use of Privileged APIs vulnerability in Unity P…8.4
• CVE-2026-54425Uncontrolled recursion in the HTTP/2 HPACK decoder in Apache…7.5
• CVE-2026-54426Uncontrolled recursion in the Redis reply parser in Apache b…7.5
• CVE-2026-54428Allocation of resources without limits or throttling in the …7.5
• CVE-2026-54429A vulnerability has been identified in SIMATIC S7-PLCSIM Adv…7.4
• CVE-2026-5443A heap buffer overflow vulnerability exists during the decod…9.8
• CVE-2026-54430liboauth2 is vulnerable to Server-Side Request Forgery in oa…5.1
• CVE-2026-54431In liboauth2 the Demonstrating Proof-of-Possession (DPoP) ve…5.1
• CVE-2026-54432Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2 allow…4.7