Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-74758— Apache bRPC: Heap Use-After-Free in RTMP Abort Message Handling

Quick assessment

Affected
Apache Software Foundation Apache bRPC
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Apache bRPC 的 RTMP 协议组件中存在堆释放后使用漏洞（影响版本 < 1.18.0）。远程攻击者无需任何身份验证或应用层请求，即可通过发送特制的 Abort 控制消息，导致 bRPC RTMP 服务器崩溃。 根本原因： 当 RTMP Abort 控制消息指定当前正在解析的块流（即承载该消息本身的块流）时， 会调用 ，后者在 方法仍在执行时删除了 对象。待消息处理函数返回后， 继续访问已被释放对象的成员，从而引发堆释放后使用漏洞。 受影响场景： 启用了 RTMP 支持（即设置了 ）并接受来自不可信网络连

AI Predicted 7.5 Difficulty: Moderate

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-74758

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Apache bRPC: Heap Use-After-Free in RTMP Abort Message Handling
Source: CVE Program / CVE List V5
Vulnerability Description
A heap use-after-free in the RTMP protocol component of Apache bRPC (versions < 1.18.0) allows a remote attacker to crash a bRPC RTMP server by sending a crafted Abort control message. No authentication or application-level request is required. Root Cause: When an RTMP Abort control message names the chunk stream that is currently being parsed (the chunk stream carrying the message itself), RtmpChunkStream::OnAbortMessage calls RtmpContext::ClearChunkStream, which deletes the RtmpChunkStream while its Feed() is still running. After the message handler returns, Feed() continues to access members of the deleted object, resulting in a heap-use-after-free. Affected Scenarios: bRPC servers that enable RTMP support (ServerOptions.rtmp_service set) and accept connections from untrusted networks. How to Fix: 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch:  https://github.com/apache/brpc/pull/3452 The fix skips clearing the chunk stream when the Abort message targets the chunk stream that is currently being parsed.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
释放后使用
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Apache Software Foundation Apache bRPC 0 ~ 1.18.0 -

II. Public POCs for CVE-2026-74758

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-74758

请登录查看更多情报信息。

Other References for CVE-2026-74758 (1)

Same Patch Batch · Apache Software Foundation · 2026-10-21 · 39 CVEs total

CVE-2026-56386 Apache bRPC: Integer Underflow and Out-of-Bounds Read in HTTP/2 DATA Frame Parser
CVE-2026-78048 Apache bRPC: Remote Denial of Service via Out-of-Bounds Dynamic Table Sizing in HPACK Deco
CVE-2026-74757 Apache bRPC: Uncontrolled Memory Allocation via Malicious mcpack Array Item Count
CVE-2026-74755 Apache bRPC: Integer Underflow in mcpack2pb Parser Leading to Denial of Service
CVE-2026-66392 Apache bRPC: TLS Client Accepts Certificates for Mismatched Peer Names
CVE-2026-61916 Apache bRPC: Out-of-bounds Read in URL and Header Lookup Tables on Unsigned-char Platforms
CVE-2026-61902 Apache bRPC: Memory Exhaustion Through Inconsistent Message Body Limits
CVE-2026-58064 Apache bRPC: Denial of Service via Unbounded Redis Inline Command Allocation
CVE-2026-56388 Apache bRPC: Out-of-Bounds Write in Redis Command Parser
CVE-2026-56387 Apache bRPC: Remote Memory Exhaustion in RTMP AMF Parser
CVE-2026-78058 Apache bRPC: Unbounded Resource Consumption and Crash in the HTTP/2 Receive Path
CVE-2026-54427 Apache bRPC: Stack Exhaustion via Unbounded Recursion in AMF Parser
CVE-2026-54426 Apache bRPC: Stack Exhaustion via Unbounded Recursion in Redis Reply Parser
CVE-2026-54425 Apache bRPC: Stack Exhaustion via Recursive HPACK Dynamic Table Size Update Decoding
CVE-2026-48830 Apache bRPC: HTTP builtin request can mark a connection authenticated and bypass auth for
CVE-2026-59229 Apache IoTDB: Legacy Pipe Privilege Escalation
CVE-2026-59562 Apache IoTDB: Remote code execution and Unauthenticated path traversal in legacy pipe send
CVE-2026-41114 Apache IoTDB JDBC driver: Large-scale Memory Exhaustion via BigDecimal toPlainString in JD
CVE-2026-58663 Apache IoTDB: Auth Bypass in pipeTransfer() interface
CVE-2026-82425 Apache bRPC: Reachable Assertion in Socket::OnInputEvent Allows Remote Denial of Service

Showing top 20 of 39 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Apache bRPC
Same vendor: Apache Software Foundation
Same weakness: CWE-416

V. Comments for CVE-2026-74758

No comments yet

Leave a comment