CVE-2026-74758

{
  "etk_id": "ETK-2026-2340",
  "cve_id": "CVE-2026-74758",
  "display_id": "CVE-2026-74758",
  "ghsa_id": "GHSA-jhf7-xcw3-gmv5",
  "euvd_id": "EUVD-2026-107182",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Use-after-free in Apache bRPC RTMP handling",
  "summary": "Apache bRPC versions before 1.18.0 are affected when an RTMP service is enabled. An unauthenticated remote client can cause an affected RTMP server to crash if the service accepts connections from an untrusted network.",
  "mitigation": "Upgrade apache/brpc to version 1.18.0. Until upgraded, disable RTMP support or limit RTMP access to trusted networks.",
  "vendor": "Apache Software Foundation",
  "product": "Apache bRPC",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 1.18.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "1.18.0"
      ],
      "package_name": "apache/brpc",
      "purl": null
    }
  ],
  "cwes": [
    416
  ],
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 68.64748471666667,
  "t0_at": "2026-10-21T11:48:23.883000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-21T11:48:23.883000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-21T11:48:23.883000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74758"
    }
  }
}