Threats tagged 'ghsa-73m6-hpcv-jggj'

Apache bRPC versions prior to 1.18.0 contain an uncontrolled recursion vulnerability in the AMF parser. A remote RTMP peer can send deeply nested AMF objects or arrays to cause a stack exhaustion and crash the bRPC process. The flaw affects applications using bRPC RTMP support that parse AMF data from untrusted sources. The issue is fixed in version 1.18.0 by introducing a configurable maximum AMF nesting depth, defaulting to 128.