---
id: CVE-2026-87849
title: >-
  Apache bRPC: Out-of-bounds read via non-object fields in Discovery
  naming-service reply parsing
summary: >-
  The Discovery naming-service reply parser in Apache bRPC (versions < 1.18.0)
  calls RapidJSON object-only accessors (FindMember) on JSON values without
  first validating that those values are objects. A malformed Discovery response
  whose d…
severity: none
cwe:
  - CWE-125
vendor: Apache Software Foundation
product: apache/brpc
affected:
  - apache/brpc < 1.18.0
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:18:29.706Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-87849'
references:
  - url: 'https://github.com/apache/brpc/pull/3533'
  - url: 'https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb'
tags:
  - cve.org
ingestedAt: '2026-10-21T12:48:53.755Z'
---

## Overview

The Discovery naming-service reply parser in Apache bRPC (versions < 1.18.0) calls RapidJSON object-only accessors (FindMember) on JSON values without first validating that those values are objects. A malformed Discovery response whose data/service members or instances list contain non-object entries (e.g. a bare integer) triggers the RapidJSON object-access precondition on the client, reading memory out of bounds and potentially crashing the bRPC client.

Root Cause:
In src/brpc/policy/discovery_naming_service.cpp, DiscoveryNamingService::GetServers() and DiscoveryNames::ListDiscoveryNodes() access JSON values with member functions on non-object values. RapidJSON only defines these operations for object types; invoking them on a non-object violates the class invariant and results in undefined behavior (out-of-bounds read), commonly crashing the process.

Affected Scenarios: 
An operator-configured (or compromised) Discovery backend returns a malformed /discovery/nodes or /discovery/fetchs response whose data/service/instance entries are not JSON objects, crashing any bRPC client that refreshes its server list.

How to Fix:
1. Upgrade bRPC to version 1.18.0 or later, which fixes this issue.
2. Apply this patch: https://github.com/apache/brpc/pull/3533

The fix validates that the Discovery response data, per-service data, and instance entries are JSON objects (and skips non-object node/instance entries and rejects non-object data/service values) before calling member accessors.

## Affected

- `apache/brpc < 1.18.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.