CVE-2026-82953: NULL pointer dereference in the RTMP protocol implementation in Apache bRPC (version _onfail_id, causing the process to crash. Affected Scenarios: Run an…

PriorityP430

EPSS

0.22%

12.6th percentile

NULL pointer dereference in the RTMP protocol implementation in Apache bRPC (version _onfail_id, causing the process to crash. Affected Scenarios: Run an Apache bRPC RTMP server whose RtmpService::NewStream() may return null (i.e., the service rejects createStream requests). A remote client that sends a createStream command and then closes the connection before the rejection response is written can crash the server. How to Fix: (Choose one of the following options) 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3508

Affected

1 ranges

Vendor	Product	Version range	Fixed in
apache_software_foundation	apache_brpc	< 1.18.0	1.18.0

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.