一线运维实战手记 · 云计算 · 数据库 · 故障排查
2026年10月22日

CVE-2026-82953 – NULL pointer dereference in the RTMP protocol implementation in Apache bRPC (version < 1.1

未分类
📑 文章目录

NULL pointer dereference in the RTMP protocol implementation in Apache bRPC (version _onfail_id, causing the process to crash.

Affected Scenarios:
Run an Apache bRPC RTMP server whose RtmpService::NewStream() may return null (i.e., the service rejects createStream requests). A remote client that sends a createStream command and then closes the connection before the rejection response is written can crash the server.

How to Fix:
(Choose one of the following options)
1. Upgrade bRPC to version 1.18.0, which fixes this issue.
2. Apply this patch: https://github.com/apache/brpc/pull/3508