CVE-2026-87849
- Source
- https://cve.org/CVERecord?id=CVE-2026-87849
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-87849.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-87849
- Published
- 2026-10-21T12:18:29Z
- Modified
- 2026-10-22T02:49:10Z
- Summary
- Apache bRPC: Out-of-bounds read via non-object fields in Discovery naming-service reply parsing
- Details
-
The Discovery naming-service reply parser in Apache bRPC (versions < 1.18.0) calls RapidJSON object-only accessors (FindMember) on JSON values without first validating that those values are objects. A malformed Discovery response whose data/service members or instances list contain non-object entries (e.g. a bare integer) triggers the RapidJSON object-access precondition on the client, reading memory out of bounds and potentially crashing the bRPC client.
Root Cause: In src/brpc/policy/discovery_naming_service.cpp, DiscoveryNamingService::GetServers() and DiscoveryNames::ListDiscoveryNodes() access JSON values with member functions on non-object values. RapidJSON only defines these operations for object types; invoking them on a non-object violates the class invariant and results in undefined behavior (out-of-bounds read), commonly crashing the process.
Affected Scenarios: An operator-configured (or compromised) Discovery backend returns a malformed /discovery/nodes or /discovery/fetchs response whose data/service/instance entries are not JSON objects, crashing any bRPC client that refreshes its server list.
How to Fix:
- Upgrade bRPC to version 1.18.0 or later, which fixes this issue.
- Apply this patch: https://github.com/apache/brpc/pull/3533
The fix validates that the Discovery response data, per-service data, and instance entries are JSON objects (and skips non-object node/instance entries and rejects non-object data/service values) before calling member accessors.
- Database specific
{ "cna_assigner": "apache", "cwe_ids": [ "CWE-125" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87849.json" }- References
Affected packages
Git / github.com/apache/brpc
Affected ranges
- Type
- GIT
- Repo
- https://github.com/apache/brpc
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "0" }, { "fixed": "1.18.0" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" } ] }