{"id":"CVE-2026-87849","summary":"Apache bRPC: Out-of-bounds read via non-object fields in Discovery naming-service reply parsing","details":"The Discovery naming-service reply parser in Apache bRPC (versions \u003c 1.18.0) calls RapidJSON object-only accessors (FindMember) on JSON values without first validating that those values are objects. A malformed Discovery response whose data/service members or instances list contain non-object entries (e.g. a bare integer) triggers the RapidJSON object-access precondition on the client, reading memory out of bounds and potentially crashing the bRPC client.\n\nRoot Cause:\nIn src/brpc/policy/discovery_naming_service.cpp, DiscoveryNamingService::GetServers() and DiscoveryNames::ListDiscoveryNodes() access JSON values with member functions on non-object values. RapidJSON only defines these operations for object types; invoking them on a non-object violates the class invariant and results in undefined behavior (out-of-bounds read), commonly crashing the process.\n\nAffected Scenarios: \nAn operator-configured (or compromised) Discovery backend returns a malformed /discovery/nodes or /discovery/fetchs response whose data/service/instance entries are not JSON objects, crashing any bRPC client that refreshes its server list.\n\nHow to Fix:\n1. Upgrade bRPC to version 1.18.0 or later, which fixes this issue.\n2. Apply this patch: https://github.com/apache/brpc/pull/3533\n\nThe fix validates that the Discovery response data, per-service data, and instance entries are JSON objects (and skips non-object node/instance entries and rejects non-object data/service values) before calling member accessors.","modified":"2026-10-22T02:49:10.351006981Z","published":"2026-10-21T12:18:29.706Z","database_specific":{"cwe_ids":["CWE-125"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87849.json","cna_assigner":"apache"},"references":[{"type":"WEB","url":"https://github.com"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87849.json"},{"type":"FIX","url":"https://github.com/apache/brpc/pull/3533"},{"type":"ADVISORY","url":"https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87849"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apache/brpc","events":[{"introduced":"0"},{"fixed":"94f1bbd32845a45f0218dfe43e25791252bdcb72"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0"},{"fixed":"1.18.0"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"}]}}],"versions":["1.13.0","1.0.0","1.0.0-rc02","1.0.0-rc01","0.9.8-rc01","0.9.7-rc02","0.9.7-rc03","0.9.7","0.9.7-rc01","0.9.6-rc03","0.9.6-rc02","0.9.6-rc01","0.9.6","0.9.5","v0.9.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-87849.json"}}],"schema_version":"1.9.0"}