{"id":"CVE-2026-87849","title":"Apache bRPC: Out-of-bounds read via non-object fields in Discovery naming-service reply parsing","summary":"The Discovery naming-service reply parser in Apache bRPC (versions < 1.18.0) calls RapidJSON object-only accessors (FindMember) on JSON values without first validating that those values are objects. A malformed Discovery response whose d…","severity":"none","cwe":["CWE-125"],"vendor":"Apache Software Foundation","product":"apache/brpc","affected":["apache/brpc < 1.18.0"],"published":"2026-10-21","updated":"2026-10-21","sourceUpdated":"2026-10-21T12:18:29.706Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-87849","references":[{"url":"https://github.com/apache/brpc/pull/3533"},{"url":"https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb"}],"tags":["cve.org"],"ingestedAt":"2026-10-21T12:48:53.755Z","slug":"CVE-2026-87849","body":"## Overview\n\nThe Discovery naming-service reply parser in Apache bRPC (versions < 1.18.0) calls RapidJSON object-only accessors (FindMember) on JSON values without first validating that those values are objects. A malformed Discovery response whose data/service members or instances list contain non-object entries (e.g. a bare integer) triggers the RapidJSON object-access precondition on the client, reading memory out of bounds and potentially crashing the bRPC client.\n\nRoot Cause:\nIn src/brpc/policy/discovery_naming_service.cpp, DiscoveryNamingService::GetServers() and DiscoveryNames::ListDiscoveryNodes() access JSON values with member functions on non-object values. RapidJSON only defines these operations for object types; invoking them on a non-object violates the class invariant and results in undefined behavior (out-of-bounds read), commonly crashing the process.\n\nAffected Scenarios: \nAn operator-configured (or compromised) Discovery backend returns a malformed /discovery/nodes or /discovery/fetchs response whose data/service/instance entries are not JSON objects, crashing any bRPC client that refreshes its server list.\n\nHow to Fix:\n1. Upgrade bRPC to version 1.18.0 or later, which fixes this issue.\n2. Apply this patch: https://github.com/apache/brpc/pull/3533\n\nThe fix validates that the Discovery response data, per-service data, and instance entries are JSON objects (and skips non-object node/instance entries and rejects non-object data/service values) before calling member accessors.\n\n## Affected\n\n- `apache/brpc < 1.18.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}