CVE-2026-82953

Name of the Vulnerable Software and Affected Versions Apache bRPC versions prior to 1.18.0

Description A NULL pointer dereference in the RTMP protocol implementation allows remote attackers to cause a denial of service by crashing the server. This occurs when the RtmpService::NewStream() function returns a null stream to reject a createStream command. If the server fails to write the rejection response to the client—such as when a client closes the connection immediately after sending the command—the error-handling path in the RtmpChunkStream::OnCreateStream() function attempts to access the stream-> onfail id variable using the null pointer, leading to a process crash.

Recommendations Upgrade to version 1.18.0.