{"id":"CVE-2026-87849","revision":"6e49e653fb7c4fda924db45ae08ff595","records":[{"revision":"6e49e653fb7c4fda924db45ae08ff595","observedAt":"2026-10-26T15:35:30.984+00:00","statement":{"source":"cve-program","id":"CVE-2026-87849","aliases":[],"title":"Apache bRPC: Out-of-bounds read via non-object fields in Discovery naming-service reply parsing","description":"The Discovery naming-service reply parser in Apache bRPC (versions < 1.18.0) calls RapidJSON object-only accessors (FindMember) on JSON values without first validating that those values are objects. A malformed Discovery response whose data/service members or instances list contain non-object entries (e.g. a bare integer) triggers the RapidJSON object-access precondition on the client, reading memory out of bounds and potentially crashing the bRPC client.\n\nRoot Cause:\nIn src/brpc/policy/discovery_naming_service.cpp, DiscoveryNamingService::GetServers() and DiscoveryNames::ListDiscoveryNodes() access JSON values with member functions on non-object values. RapidJSON only defines these operations for object types; invoking them on a non-object violates the class invariant and results in undefined behavior (out-of-bounds read), commonly crashing the process.\n\nAffected Scenarios: \nAn operator-configured (or compromised) Discovery backend returns a malformed /discovery/nodes or /discovery/fetchs response whose data/service/instance entries are not JSON objects, crashing any bRPC client that refreshes its server list.\n\nHow to Fix:\n1. Upgrade bRPC to version 1.18.0 or later, which fixes this issue.\n2. Apply this patch: https://github.com/apache/brpc/pull/3533\n\nThe fix validates that the Discovery response data, per-service data, and instance entries are JSON objects (and skips non-object node/instance entries and rejects non-object data/service values) before calling member accessors.","state":0,"publishedAt":"2026-10-21T12:18:29.706+00:00","modifiedAt":"2026-10-26T13:54:40.137+00:00","affected":[{"ecosystem":"https://github.com","name":"apache/brpc","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Apache Software Foundation\",\n                    \"product\": \"Apache bRPC\",\n                    \"packageURL\": \"pkg:github/apache/brpc\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"lessThan\": \"1.18.0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\",\n                    \"collectionURL\": \"https://github.com\",\n                    \"packageName\": \"apache/brpc\"\n                }"}],"metrics":[],"references":["https://github.com/apache/brpc/pull/3533","https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-87849","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-87849","identifiers":["CVE-2026-87849"]},"retained":false,"historicalAffected":[]}],"coverage":[]}