CVE-2026-56387

The RTMP AMF parser in Apache bRPC accepts AMF string lengths and array counts directly from untrusted input. A remote unauthenticated attacker who can reach a bRPC server with RTMP enabled can send a small AMF payload with an excessive declared long string length or array count, causing excessive memory allocation or resource consumption before the parser rejects the incomplete payload. Root Cause: The AMF long string parser resized the destination string to the declared 32-bit length before validating that the stream contained that many bytes. ECMA array and strict array parsers also accepted 32-bit element counts without a configurable upper bound. Affected Scenarios: Deployments that enable the bRPC RTMP server component and accept RTMP traffic from untrusted clients. Direct uses of the AMF parser on untrusted data are also affected. How to Fix: 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch:  https://github.com/apache/brpc/pull/3353 Note: The fix introduces configurable AMF parsing limits. The default maximum string size is 64 MiB and the default maximum array element count is 1,048,576. Payloads above these limits are rejected. The limits can be adjusted with amf_max_string_size and amf_max_array_size.

• CWE-770
• CWE-789

• https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb

Published

Oct 21, 2026

Last Modified

Oct 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-56381Craft CMS from version 5.0.0-RC1 contains a stored cross-sit…4.8
• CVE-2026-56382Craft CMS (composer package craftcms/cms) versions >= 5.5.0 …7.2
• CVE-2026-56383Craft CMS contains a stored cross-site scripting (XSS) vulne…4.8
• CVE-2026-56384Craft CMS contains a missing authorization vulnerability in …4.3
• CVE-2026-56385Craft CMS versions >= 5.0.0-RC1, <= 5.9.13 and >= 4.0.0-RC1,…4.3
• CVE-2026-56386Integer underflow and out-of-bounds read in the HTTP/2 serve…7.5
• CVE-2026-56388The Redis server command parser in Apache bRPC accepts an em…9.1
• CVE-2026-56389GNU Bison allows for an execution of an arbitrary program du…8.6
• CVE-2026-5639A flaw has been found in PHPGurukul Online Shopping Portal P…6.3
• CVE-2026-56390GNU Bison improperly handles grammar‑defined output paths. G…6.3
• CVE-2026-56391GNU coreutils uniq is vulnerable to an out‑of‑bounds read du…6.1
• CVE-2026-56392GNU coreutils unexpand is vulnerable to a heap-based buffer …6.1