CVE-2026-87849

Deferred Deferred - Pending Action

Memory Corruption in Apache bRPC Discovery Response Parser

Publication date: 2026-10-21

Last updated on: 2026-10-26

Assigner: Apache Software Foundation

Description

The Discovery naming-service reply parser in Apache bRPC (versions < 1.18.0) calls RapidJSON object-only accessors (FindMember) on JSON values without first validating that those values are objects. A malformed Discovery response whose data/service members or instances list contain non-object entries (e.g. a bare integer) triggers the RapidJSON object-access precondition on the client, reading memory out of bounds and potentially crashing the bRPC client. Root Cause: In src/brpc/policy/discovery_naming_service.cpp, DiscoveryNamingService::GetServers() and DiscoveryNames::ListDiscoveryNodes() access JSON values with member functions on non-object values. RapidJSON only defines these operations for object types; invoking them on a non-object violates the class invariant and results in undefined behavior (out-of-bounds read), commonly crashing the process. Affected Scenarios: An operator-configured (or compromised) Discovery backend returns a malformed /discovery/nodes or /discovery/fetchs response whose data/service/instance entries are not JSON objects, crashing any bRPC client that refreshes its server list. How to Fix: 1. Upgrade bRPC to version 1.18.0 or later, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3533 The fix validates that the Discovery response data, per-service data, and instance entries are JSON objects (and skips non-object node/instance entries and rejects non-object data/service values) before calling member accessors.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-26

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-09

NVD

CVE-2026-87849

EUVD

EUVD-2026-107229

Affected Vendors & Products

Vendor	Product	Version / Range
Apache Software Foundation	Apache bRPC	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability affects Apache bRPC versions before 1.18.0. The Discovery naming-service reply parser fails to validate JSON object types before accessing object members in Discovery responses. A malformed response with non-object entries (like integers) causes RapidJSON to read memory out of bounds, leading to undefined behavior such as crashes.

Detection Guidance

To detect this vulnerability, monitor bRPC client crashes during Discovery service refreshes. Check logs for segmentation faults or out-of-bounds read errors when processing /discovery/nodes or /discovery/fetchs responses. Verify bRPC version is below 1.18.0 using commands like 'brpc_server --version' or inspecting package managers.

Impact Analysis

If you use a vulnerable bRPC version and a Discovery backend returns a malformed response, your bRPC client may crash when refreshing its server list. This could disrupt services relying on bRPC for communication or discovery.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It causes crashes in bRPC clients due to malformed Discovery responses, which could disrupt services but does not inherently violate data protection or privacy requirements.

Mitigation Strategies

Upgrade Apache bRPC to version 1.18.0 or later. Alternatively, apply the patch from https://github.com/apache/brpc/pull/3533 to validate JSON object types before accessing members.

Hi! I’m here to help you understand CVE-2026-87849. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...