CVE-2026-82953

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-82953
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82953.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-82953
Published
2026-10-21T12:10:07Z
Modified
2026-10-22T02:48:53Z
Summary
Apache bRPC: NULL Pointer Dereference in RTMP createStream Error Path Leading to Remote Denial of Service
Details

NULL pointer dereference in the RTMP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to crash the server (denial of service) via a crafted createStream command.

Root Cause: When an RTMP service rejects a createStream request by returning a null stream from RtmpService::NewStream(), the server sends an error response to the client. If writing this rejection response fails (for example, because the client closes the connection immediately after sending the createStream command), the error-handling path in RtmpChunkStream::OnCreateStream() dereferences the null stream pointer to access stream->_onfail_id, causing the process to crash.

Affected Scenarios: Run an Apache bRPC RTMP server whose RtmpService::NewStream() may return null (i.e., the service rejects createStream requests). A remote client that sends a createStream command and then closes the connection before the rejection response is written can crash the server.

How to Fix: (Choose one of the following options)

  1. Upgrade bRPC to version 1.18.0, which fixes this issue.
  2. Apply this patch: https://github.com/apache/brpc/pull/3508
Database specific 
{
    "cna_assigner":  "apache",
    "cwe_ids":  [
        "CWE-476"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82953.json"
}
References

Affected packages

Git / github.com/apache/brpc

Affected ranges

Type
GIT
Repo
https://github.com/apache/brpc
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
94f1bbd32845a45f0218dfe43e25791252bdcb72
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "1.18.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        }
    ]
}

Affected versions

0.*
0.9.5
0.9.6
0.9.6-rc01
0.9.6-rc02
0.9.6-rc03
0.9.7
0.9.7-rc01
0.9.7-rc02
0.9.7-rc03
0.9.8-rc01
1.*
1.0.0
1.0.0-rc01
1.0.0-rc02
1.13.0
v0.*
v0.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82953.json"