Live › vulnerability › CVE-2026-87849
Go to dashboardThe Discovery naming-service reply parser in Apache bRPC before 1.18.0 calls object-only JSON accessors on values that may not be objects, causing out-of-bounds memory reads. An attacker controlling or compromising the Discovery backend can crash any bRPC client that refreshes its server list.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only clients that use bRPC's Discovery naming service to refresh server lists are exposed, and the trigger requires a malformed /discovery/nodes or /discovery/fetchs response from the Discovery backend. Teams not using the Discovery naming service can skip it, though they should still confirm the bRPC version.
No product ranges from the sources yet.
grep -ri brpc in your build files or ldd on the binary, and compare it to 1.18.0discovery:// in client configuration1.18.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Discovery naming-service reply parser in Apache bRPC (versions < 1.18.0) calls RapidJSON object-only accessors (FindMember) on JSON values without first validating that those values are objects. A malformed Discovery response whose data/service members or instances list contain non-object entries (e.g. a bare integer) triggers the RapidJSON object-access precondition on the client, reading memory out of bounds and potentially crashing the bRPC client.
Root Cause: In src/brpc/policy/discovery_naming_service.cpp, DiscoveryNamingService::GetServers() and DiscoveryNames::ListDiscoveryNodes() access JSON values with member functions on non-object values. RapidJSON only defines these operations for object types; invoking them on a non-object violates the class invariant and results in undefined behavior (out-of-bounds read), commonly crashing the process.
Affected Scenarios: An operator-configured (or compromised) Discovery backend returns a malformed /discovery/nodes or /discovery/fetchs response whose data/service/instance entries are not JSON objects, crashing any bRPC client that refreshes its server list.
How to Fix:
The fix validates that the Discovery response data, per-service data, and instance entries are JSON objects (and skips non-object node/instance entries and rejects non-object data/service values) before calling member accessors.
This page as .md · .json · in your agent: get_signal("CVE-2026-87849")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.