Allocation of Resources Without Limits or Throttling in Apache bRPC - CVE-2026-56387
Published: October 23, 2026
Vulnerability identifier: #VU157341
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-56387
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service through excessive memory allocation and resource consumption.
The vulnerability exists due to uncontrolled resource allocation in Apache bRPC's RTMP AMF parser when accepting untrusted string lengths and array counts before validating the available input or enforcing allocation limits. A remote attacker can send a small AMF payload declaring an excessive long string length or array count to consume excessive resources before the incomplete payload is rejected.
Affected software
Apache bRPC
How to mitigate CVE-2026-56387
Install security update from vendor's website.
Apache bRPC - update to 1.18.0