CVE-2026-56387

{
  "etk_id": "ETK-2026-2316",
  "cve_id": "CVE-2026-56387",
  "display_id": "CVE-2026-56387",
  "ghsa_id": "GHSA-79v7-r95h-fxr5",
  "euvd_id": "EUVD-2026-107173",
  "status": "published",
  "anchor_state": "anchored",
  "title": "RTMP AMF resource exhaustion in Apache bRPC",
  "summary": "Apache bRPC deployments with the RTMP server enabled, and applications that parse untrusted AMF data directly, are affected. An unauthenticated remote attacker able to send RTMP traffic can cause excessive memory allocation or resource consumption using oversized declared AMF string lengths or array counts.",
  "mitigation": "Upgrade apache/brpc to version 1.18.0. Configure AMF string and array-size limits appropriate for the deployment, and restrict untrusted access to RTMP services where possible.",
  "vendor": "Apache Software Foundation",
  "product": "Apache bRPC",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 1.18.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "1.18.0"
      ],
      "package_name": "apache/brpc",
      "purl": null
    }
  ],
  "cwes": [
    789
  ],
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 62.988388666666665,
  "t0_at": "2026-10-21T11:39:11.225000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-21T11:39:11.225000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-21T11:39:11.225000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56387"
    }
  }
}