{"id":44038,"date":"2026-10-21T20:38:33","date_gmt":"2026-10-21T12:38:33","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-74758"},"modified":"2026-10-21T20:38:33","modified_gmt":"2026-10-21T12:38:33","slug":"cve-2026-74758","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-74758","title":{"rendered":"CVE-2026-74758 &#8211; A heap use-after-free in the RTMP protocol component of Apache bRPC (versions &lt; 1.18.0) al"},"content":{"rendered":"<p>A heap use-after-free in the RTMP protocol component of Apache bRPC (versions &lt; 1.18.0) allows a remote attacker to crash a bRPC RTMP server by sending a crafted Abort control message. No authentication or application-level request is required.<\/p>\n<p>Root Cause:<br \/>\nWhen an RTMP Abort control message names the chunk stream that is currently being parsed (the chunk stream carrying the message itself), RtmpChunkStream::OnAbortMessage calls RtmpContext::ClearChunkStream, which deletes the RtmpChunkStream while its Feed() is still running. After the message handler returns, Feed() continues to access members of the deleted object, resulting in a heap-use-after-free.<\/p>\n<p>Affected Scenarios:<br \/>\nbRPC servers that enable RTMP support (ServerOptions.rtmp_service set) and accept connections from untrusted networks.<\/p>\n<p>How to Fix:<br \/>\n1. Upgrade bRPC to version 1.18.0, which fixes this issue.<br \/>\n2. Apply this patch:\u00a0 https:\/\/github.com\/apache\/brpc\/pull\/3452 <\/p>\n<p>The fix skips clearing the chunk stream when the Abort message targets the chunk stream that is currently being parsed.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A heap use-after-free in the RTMP protocol component of Apache bRPC (versions &lt; 1.18.0) allows a remote attacker to crash a bRPC RTMP server by sending a crafted Abort control message. No authenticati<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-44038","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/44038","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=44038"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=44038"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=44038"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}