CVE-2026-56387 Apache Software Foundation CVE debrief

Who should care

Defenders responsible for Apache bRPC deployments that enable the RTMP server component and accept RTMP traffic from untrusted clients should assess exposure and prioritize remediation. Defenders should also review and adjust AMF parsing limits as needed to prevent potential memory exhaustion attacks.

Why it matters

Defenders should care about this vulnerability because it allows remote memory exhaustion in Apache bRPC's RTMP AMF parser, potentially leading to resource consumption and denial-of-service (DoS) attacks. Affected deployments should prioritize upgrading to version 1.18.0 or applying the provided patch.

• Potential for memory exhaustion leading to resource consumption
• Need for verification of affected versions and exposure
• Priority for upgrading or patching vulnerable deployments
• Potential for denial-of-service (DoS) attacks

Technical summary

The RTMP AMF parser in Apache bRPC accepts AMF string lengths and array counts directly from untrusted input, allowing a remote unauthenticated attacker to cause excessive memory allocation or resource consumption before the parser rejects the incomplete payload. The root cause of the vulnerability is that the AMF long string parser resized the destination string to the declared 32-bit length before validating that the stream contained that many bytes. ECMA array and strict array parsers also accepted 32-bit element counts without a configurable upper bound.

Defensive priority

Defenders should prioritize upgrading to bRPC version 1.18.0 or applying the provided patch to prevent potential memory exhaustion attacks.

Recommended defensive actions

• Upgrade to bRPC version 1.18.0
• Apply the provided patch
• Review and adjust AMF parsing limits as needed
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its root cause, affected scenarios, and fixed versions. The RTMP AMF parser in Apache bRPC accepts AMF string lengths and array counts directly from untrusted input, allowing a remote unauthenticated attacker to cause excessive memory allocation. The fix introduces configurable AMF parsing limits. The default maximum string size is 64 MiB and the default maximum array element count is 1,048,576. Payloads above these limits are rejected. Defenders should to

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.