Threats tagged 'ghsa-79v7-r95h-fxr5'

Apache bRPC's RTMP AMF parser improperly accepts AMF string lengths and array counts directly from untrusted input without sufficient validation. This allows a remote unauthenticated attacker to send a crafted AMF payload with excessive declared sizes, causing excessive memory allocation or resource consumption, potentially leading to denial of service. The issue affects deployments with RTMP enabled and untrusted client traffic. The vulnerability is fixed in bRPC version 1.18.0, which introduces configurable limits on AMF parsing to prevent such attacks.