CVE-2026-56387: CWE-789 Memory Allocation with Excessive Size Value in Apache Software Foundation Apache bRPC

The RTMP AMF parser in Apache bRPC accepts AMF string lengths and array counts directly from untrusted input without sufficient validation. Specifically, the parser resizes the destination string to the declared 32-bit length before verifying the stream contains that many bytes. Similarly, ECMA and strict array parsers accept 32-bit element counts without an upper bound. This can cause excessive memory allocation or resource consumption when processing crafted payloads. The vulnerability affects bRPC versions prior to 1.18.0 where the RTMP server component is enabled. The issue is addressed in version 1.18.0 by adding configurable maximum limits for string size (default 64 MiB) and array size (default 1,048,576 elements), rejecting payloads exceeding these limits.

A remote unauthenticated attacker able to send RTMP traffic to a vulnerable bRPC server can cause excessive memory allocation or resource consumption, potentially leading to denial of service conditions. The vulnerability arises before the parser rejects incomplete payloads, allowing resource exhaustion attacks.

Upgrade Apache bRPC to version 1.18.0 or later, which includes the fix introducing configurable limits on AMF string and array sizes. The default limits reject payloads with string sizes over 64 MiB and array counts over 1,048,576 elements. Adjust these limits as needed using the amf_max_string_size and amf_max_array_size configuration options. No other mitigation is indicated by the vendor advisory.