CVE-2026-54427: CWE-674 Uncontrolled Recursion in Apache Software Foundation Apache bRPC

CVE-2026-54427 is an uncontrolled recursion vulnerability in the AMF parser of Apache bRPC versions before 1.18.0. The parser recursively processes nested AMF containers without enforcing a depth limit, allowing a remote RTMP peer to cause a stack exhaustion and crash the bRPC process by sending deeply nested AMF objects or arrays. This affects scenarios where bRPC RTMP support parses AMF data from untrusted RTMP peers, including RTMP servers, clients, and direct callers of ReadAMFObject or ReadAMFArray on untrusted input. The issue is resolved in Apache bRPC 1.18.0 by adding a configurable AMF nesting depth limit, rejecting objects or arrays deeper than the default limit of 128.

A remote attacker controlling an RTMP peer can cause a denial of service by crashing the bRPC process through sending deeply nested AMF data. This impacts availability of applications using vulnerable versions of Apache bRPC that parse AMF data from untrusted sources. There is no indication of code execution or data disclosure from the provided information.

Upgrade Apache bRPC to version 1.18.0 or later, which includes a fix that enforces a configurable maximum AMF nesting depth (default 128). Alternatively, apply the patch from the referenced pull request (https://github.com/apache/brpc/pull/3344). No other mitigation is indicated or required.