Vulnerability-Lookup

CVE-2026-74758 (GCVE-0-2026-74758)

Vulnerability from cvelistv5 – Published: 2026-10-21 11:48 – Updated: 2026-10-30 16:47

Title

Apache bRPC: Heap Use-After-Free in RTMP Abort Message Handling

Summary

A heap use-after-free in the RTMP protocol component of Apache bRPC (versions < 1.18.0) allows a remote attacker to crash a bRPC RTMP server by sending a crafted Abort control message. No authentication or application-level request is required. Root Cause: When an RTMP Abort control message names the chunk stream that is currently being parsed (the chunk stream carrying the message itself), RtmpChunkStream::OnAbortMessage calls RtmpContext::ClearChunkStream, which deletes the RtmpChunkStream while its Feed() is still running. After the message handler returns, Feed() continues to access members of the deleted object, resulting in a heap-use-after-free. Affected Scenarios: bRPC servers that enable RTMP support (ServerOptions.rtmp_service set) and accept connections from untrusted networks. How to Fix: 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3452 The fix skips clearing the chunk stream when the Abort message targets the chunk stream that is currently being parsed.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-30 16:45 UTC

CWE

CWE-416 - Use After Free

Assigner

apache CNA under the mitre root

CNA scorecard B 76/100 over 1112 records in the last 180 days details

References

1 reference

URL	Tags
https://lists.apache.org/thread/2pf15ojj0vr7rtx95…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version	CPE status
Apache Software Foundation	Apache bRPC	Affected: 0 , < 1.18.0 (semver)	guessed

Credits

Feng Zhijie (Dopamine)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-74758",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-30T16:45:05.389186Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-30T16:47:23.207Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com",
          "defaultStatus": "unaffected",
          "packageName": "apache/brpc",
          "packageURL": "pkg:github/apache/brpc",
          "product": "Apache bRPC",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "1.18.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Feng Zhijie (Dopamine)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A heap use-after-free in the RTMP protocol component of Apache bRPC (versions \u0026lt; 1.18.0) allows a remote attacker to crash a bRPC RTMP server by sending a crafted Abort control message. No authentication or application-level request is required.\u003cbr\u003e\u003cbr\u003eRoot Cause:\u003cbr\u003eWhen an RTMP Abort control message names the chunk stream that is currently being parsed (the chunk stream carrying the message itself), RtmpChunkStream::OnAbortMessage calls RtmpContext::ClearChunkStream, which deletes the RtmpChunkStream while its Feed() is still running. After the message handler returns, Feed() continues to access members of the deleted object, resulting in a heap-use-after-free.\u003cbr\u003e\u003cbr\u003eAffected Scenarios:\u003cbr\u003ebRPC servers that enable RTMP support (ServerOptions.rtmp_service set) and accept connections from untrusted networks.\u003cbr\u003e\u003cbr\u003eHow to Fix:\u003cbr\u003e1. Upgrade bRPC to version 1.18.0, which fixes this issue.\u003cbr\u003e2. Apply this patch:\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/apache/brpc/pull/3452\"\u003ehttps://github.com/apache/brpc/pull/3452\u003c/a\u003e\u003cbr\u003e\u003cbr\u003eThe fix skips clearing the chunk stream when the Abort message targets the chunk stream that is currently being parsed."
            }
          ],
          "value": "A heap use-after-free in the RTMP protocol component of Apache bRPC (versions \u003c 1.18.0) allows a remote attacker to crash a bRPC RTMP server by sending a crafted Abort control message. No authentication or application-level request is required.\n\nRoot Cause:\nWhen an RTMP Abort control message names the chunk stream that is currently being parsed (the chunk stream carrying the message itself), RtmpChunkStream::OnAbortMessage calls RtmpContext::ClearChunkStream, which deletes the RtmpChunkStream while its Feed() is still running. After the message handler returns, Feed() continues to access members of the deleted object, resulting in a heap-use-after-free.\n\nAffected Scenarios:\nbRPC servers that enable RTMP support (ServerOptions.rtmp_service set) and accept connections from untrusted networks.\n\nHow to Fix:\n1. Upgrade bRPC to version 1.18.0, which fixes this issue.\n2. Apply this patch:\u00a0 https://github.com/apache/brpc/pull/3452 \n\nThe fix skips clearing the chunk stream when the Abort message targets the chunk stream that is currently being parsed."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "high"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416 Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T11:48:23.883Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache bRPC: Heap Use-After-Free in RTMP Abort Message Handling",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-74758",
    "datePublished": "2026-10-21T11:48:23.883Z",
    "dateReserved": "2026-08-15T08:40:10.439Z",
    "dateUpdated": "2026-10-30T16:47:23.207Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74758",
      "date": "2026-11-04",
      "epss": "0.00649",
      "percentile": "0.51226"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://github.com",
                "defaultStatus": "unaffected",
                "packageName": "apache/brpc",
                "packageURL": "pkg:github/apache/brpc",
                "product": "Apache bRPC",
                "vendor": "Apache Software Foundation",
                "versions": [
                  {
                    "lessThan": "1.18.0",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "security@apache.org"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "A heap use-after-free in the RTMP protocol component of Apache bRPC (versions \u003c 1.18.0) allows a remote attacker to crash a bRPC RTMP server by sending a crafted Abort control message. No authentication or application-level request is required.\n\nRoot Cause:\nWhen an RTMP Abort control message names the chunk stream that is currently being parsed (the chunk stream carrying the message itself), RtmpChunkStream::OnAbortMessage calls RtmpContext::ClearChunkStream, which deletes the RtmpChunkStream while its Feed() is still running. After the message handler returns, Feed() continues to access members of the deleted object, resulting in a heap-use-after-free.\n\nAffected Scenarios:\nbRPC servers that enable RTMP support (ServerOptions.rtmp_service set) and accept connections from untrusted networks.\n\nHow to Fix:\n1. Upgrade bRPC to version 1.18.0, which fixes this issue.\n2. Apply this patch:\u00a0 https://github.com/apache/brpc/pull/3452 \n\nThe fix skips clearing the chunk stream when the Abort message targets the chunk stream that is currently being parsed."
          },
          {
            "lang": "es",
            "value": "Una vulnerabilidad de uso despu\u00e9s de liberaci\u00f3n en el heap en el componente del protocolo RTMP de Apache bRPC (versiones anteriores a la 1.18.0) permite a un atacante remoto provocar una ca\u00edda de un servidor bRPC RTMP enviando un mensaje de control Abort manipulado. No se requiere autenticaci\u00f3n ni solicitud a nivel de aplicaci\u00f3n.\\n\\nCausa ra\u00edz:\\nCuando un mensaje de control Abort de RTMP nombra el flujo de fragmentos que se est\u00e1 analizando (el flujo de fragmentos que transporta el propio mensaje), RtmpChunkStream::OnAbortMessage llama a RtmpContext::ClearChunkStream, que elimina el RtmpChunkStream mientras su Feed() sigue en ejecuci\u00f3n. Despu\u00e9s de que el manejador del mensaje devuelve, Feed() contin\u00faa accediendo a miembros del objeto eliminado, lo que produce un uso despu\u00e9s de liberaci\u00f3n en el heap.\\n\\nEscenarios afectados:\\nServidores bRPC que habilitan el soporte RTMP (ServerOptions.rtmp_service configurado) y aceptan conexiones desde redes no confiables.\\n\\nC\u00f3mo corregir:\\n1. Actualizar bRPC a la versi\u00f3n 1.18.0, que corrige este problema.  \\n2. Aplicar este parche: https://github.com/apache/brpc/pull/3452  \\n\\nLa correcci\u00f3n omite la limpieza del flujo de fragmentos cuando el mensaje Abort tiene como objetivo el flujo de fragmentos que se est\u00e1 analizando en ese momento."
          }
        ],
        "id": "CVE-2026-74758",
        "lastModified": "2026-10-30T17:17:28.090",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-74758",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-30T16:45:05.389186Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-10-21T12:17:22.863",
        "references": [
          {
            "source": "security@apache.org",
            "url": "https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb"
          }
        ],
        "sourceIdentifier": "security@apache.org",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "security@apache.org",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "NETWORK",
                  "availabilityImpact": "HIGH",
                  "baseScore": 7.5,
                  "baseSeverity": "HIGH",
                  "confidentialityImpact": "NONE",
                  "integrityImpact": "NONE",
                  "privilegesRequired": "NONE",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-74758",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-30T16:45:05.389186Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-30T16:47:07.985Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://github.com",
              "defaultStatus": "unaffected",
              "packageName": "apache/brpc",
              "packageURL": "pkg:github/apache/brpc",
              "product": "Apache bRPC",
              "vendor": "Apache Software Foundation",
              "versions": [
                {
                  "lessThan": "1.18.0",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Feng Zhijie (Dopamine)"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "A heap use-after-free in the RTMP protocol component of Apache bRPC (versions \u0026lt; 1.18.0) allows a remote attacker to crash a bRPC RTMP server by sending a crafted Abort control message. No authentication or application-level request is required.\u003cbr\u003e\u003cbr\u003eRoot Cause:\u003cbr\u003eWhen an RTMP Abort control message names the chunk stream that is currently being parsed (the chunk stream carrying the message itself), RtmpChunkStream::OnAbortMessage calls RtmpContext::ClearChunkStream, which deletes the RtmpChunkStream while its Feed() is still running. After the message handler returns, Feed() continues to access members of the deleted object, resulting in a heap-use-after-free.\u003cbr\u003e\u003cbr\u003eAffected Scenarios:\u003cbr\u003ebRPC servers that enable RTMP support (ServerOptions.rtmp_service set) and accept connections from untrusted networks.\u003cbr\u003e\u003cbr\u003eHow to Fix:\u003cbr\u003e1. Upgrade bRPC to version 1.18.0, which fixes this issue.\u003cbr\u003e2. Apply this patch:\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/apache/brpc/pull/3452\"\u003ehttps://github.com/apache/brpc/pull/3452\u003c/a\u003e\u003cbr\u003e\u003cbr\u003eThe fix skips clearing the chunk stream when the Abort message targets the chunk stream that is currently being parsed."
                }
              ],
              "value": "A heap use-after-free in the RTMP protocol component of Apache bRPC (versions \u003c 1.18.0) allows a remote attacker to crash a bRPC RTMP server by sending a crafted Abort control message. No authentication or application-level request is required.\n\nRoot Cause:\nWhen an RTMP Abort control message names the chunk stream that is currently being parsed (the chunk stream carrying the message itself), RtmpChunkStream::OnAbortMessage calls RtmpContext::ClearChunkStream, which deletes the RtmpChunkStream while its Feed() is still running. After the message handler returns, Feed() continues to access members of the deleted object, resulting in a heap-use-after-free.\n\nAffected Scenarios:\nbRPC servers that enable RTMP support (ServerOptions.rtmp_service set) and accept connections from untrusted networks.\n\nHow to Fix:\n1. Upgrade bRPC to version 1.18.0, which fixes this issue.\n2. Apply this patch:\u00a0 https://github.com/apache/brpc/pull/3452 \n\nThe fix skips clearing the chunk stream when the Abort message targets the chunk stream that is currently being parsed."
            }
          ],
          "metrics": [
            {
              "other": {
                "content": {
                  "text": "high"
                },
                "type": "Textual description of severity"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-416",
                  "description": "CWE-416 Use After Free",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-21T11:48:23.883Z",
            "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
            "shortName": "apache"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Apache bRPC: Heap Use-After-Free in RTMP Abort Message Handling",
          "x_generator": {
            "engine": "Vulnogram 0.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "assignerShortName": "apache",
        "cveId": "CVE-2026-74758",
        "datePublished": "2026-10-21T11:48:23.883Z",
        "dateReserved": "2026-08-15T08:40:10.439Z",
        "dateUpdated": "2026-10-30T16:47:23.207Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-74758

Vulnerability from fkie_nvd - Published: 2026-10-21 12:17 - Updated: 2026-10-30 17:17

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	security@apache.org	https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://github.com",
          "defaultStatus": "unaffected",
          "packageName": "apache/brpc",
          "packageURL": "pkg:github/apache/brpc",
          "product": "Apache bRPC",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "1.18.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "security@apache.org"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A heap use-after-free in the RTMP protocol component of Apache bRPC (versions \u003c 1.18.0) allows a remote attacker to crash a bRPC RTMP server by sending a crafted Abort control message. No authentication or application-level request is required.\n\nRoot Cause:\nWhen an RTMP Abort control message names the chunk stream that is currently being parsed (the chunk stream carrying the message itself), RtmpChunkStream::OnAbortMessage calls RtmpContext::ClearChunkStream, which deletes the RtmpChunkStream while its Feed() is still running. After the message handler returns, Feed() continues to access members of the deleted object, resulting in a heap-use-after-free.\n\nAffected Scenarios:\nbRPC servers that enable RTMP support (ServerOptions.rtmp_service set) and accept connections from untrusted networks.\n\nHow to Fix:\n1. Upgrade bRPC to version 1.18.0, which fixes this issue.\n2. Apply this patch:\u00a0 https://github.com/apache/brpc/pull/3452 \n\nThe fix skips clearing the chunk stream when the Abort message targets the chunk stream that is currently being parsed."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de uso despu\u00e9s de liberaci\u00f3n en el heap en el componente del protocolo RTMP de Apache bRPC (versiones anteriores a la 1.18.0) permite a un atacante remoto provocar una ca\u00edda de un servidor bRPC RTMP enviando un mensaje de control Abort manipulado. No se requiere autenticaci\u00f3n ni solicitud a nivel de aplicaci\u00f3n.\\n\\nCausa ra\u00edz:\\nCuando un mensaje de control Abort de RTMP nombra el flujo de fragmentos que se est\u00e1 analizando (el flujo de fragmentos que transporta el propio mensaje), RtmpChunkStream::OnAbortMessage llama a RtmpContext::ClearChunkStream, que elimina el RtmpChunkStream mientras su Feed() sigue en ejecuci\u00f3n. Despu\u00e9s de que el manejador del mensaje devuelve, Feed() contin\u00faa accediendo a miembros del objeto eliminado, lo que produce un uso despu\u00e9s de liberaci\u00f3n en el heap.\\n\\nEscenarios afectados:\\nServidores bRPC que habilitan el soporte RTMP (ServerOptions.rtmp_service configurado) y aceptan conexiones desde redes no confiables.\\n\\nC\u00f3mo corregir:\\n1. Actualizar bRPC a la versi\u00f3n 1.18.0, que corrige este problema.  \\n2. Aplicar este parche: https://github.com/apache/brpc/pull/3452  \\n\\nLa correcci\u00f3n omite la limpieza del flujo de fragmentos cuando el mensaje Abort tiene como objetivo el flujo de fragmentos que se est\u00e1 analizando en ese momento."
    }
  ],
  "id": "CVE-2026-74758",
  "lastModified": "2026-10-30T17:17:28.090",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-74758",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-30T16:45:05.389186Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-10-21T12:17:22.863",
  "references": [
    {
      "source": "security@apache.org",
      "url": "https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb"
    }
  ],
  "sourceIdentifier": "security@apache.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ],
      "source": "security@apache.org",
      "type": "Secondary"
    }
  ]
}

GHSA-JHF7-XCW3-GMV5

Vulnerability from github – Published: 2026-10-21 12:31 – Updated: 2026-10-30 18:32

Details

Root Cause: When an RTMP Abort control message names the chunk stream that is currently being parsed (the chunk stream carrying the message itself), RtmpChunkStream::OnAbortMessage calls RtmpContext::ClearChunkStream, which deletes the RtmpChunkStream while its Feed() is still running. After the message handler returns, Feed() continues to access members of the deleted object, resulting in a heap-use-after-free.

Affected Scenarios: bRPC servers that enable RTMP support (ServerOptions.rtmp_service set) and accept connections from untrusted networks.

How to Fix: 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3452

The fix skips clearing the chunk stream when the Abort message targets the chunk stream that is currently being parsed.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-74758"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-21T12:17:22Z",
    "severity": "HIGH"
  },
  "details": "A heap use-after-free in the RTMP protocol component of Apache bRPC (versions \u003c 1.18.0) allows a remote attacker to crash a bRPC RTMP server by sending a crafted Abort control message. No authentication or application-level request is required.\n\nRoot Cause:\nWhen an RTMP Abort control message names the chunk stream that is currently being parsed (the chunk stream carrying the message itself), RtmpChunkStream::OnAbortMessage calls RtmpContext::ClearChunkStream, which deletes the RtmpChunkStream while its Feed() is still running. After the message handler returns, Feed() continues to access members of the deleted object, resulting in a heap-use-after-free.\n\nAffected Scenarios:\nbRPC servers that enable RTMP support (ServerOptions.rtmp_service set) and accept connections from untrusted networks.\n\nHow to Fix:\n1. Upgrade bRPC to version 1.18.0, which fixes this issue.\n2. Apply this patch:\u00a0 https://github.com/apache/brpc/pull/3452 \n\nThe fix skips clearing the chunk stream when the Abort message targets the chunk stream that is currently being parsed.",
  "id": "GHSA-jhf7-xcw3-gmv5",
  "modified": "2026-10-30T18:32:20Z",
  "published": "2026-10-21T12:31:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74758"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-74758 (GCVE-0-2026-74758)

FKIE_CVE-2026-74758

GHSA-JHF7-XCW3-GMV5

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour