---
id: "CVE-2026-87849"
kind: "vulnerability"
aliases: ["CVE-2026-87849"]
title: "Apache bRPC: malformed Discovery reply crashes clients that refresh server lists"
severity: "medium"
cvss: null
epss: 0.00159
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["brpc", "c++", "discovery-naming-service", "package", "rpc-clients"]
not_affected_if: ["backend-trusted", "not-using-discovery-naming-service"]
published_at: "2026-10-21T13:20:04+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T05:02:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87849", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-87849", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Apache bRPC: malformed Discovery reply crashes clients that refresh server lists

The Discovery naming-service reply parser in Apache bRPC before 1.18.0 calls object-only JSON accessors on values that may not be objects, causing out-of-bounds memory reads. An attacker controlling or compromising the Discovery backend can crash any bRPC client that refreshes its server list.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the bRPC version in use, for example with `grep -ri brpc` in your build files or `ldd` on the binary, and compare it to `1.18.0`
- Look for use of the Discovery naming service, for example URLs with `discovery://` in client configuration

## Fix

- Upgrade Apache bRPC to `1.18.0` or later
- Or apply the patch from https://github.com/apache/brpc/pull/3533

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87849
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-87849

## From the sources

The Discovery naming-service reply parser in Apache bRPC (versions < 1.18.0) calls RapidJSON object-only accessors (FindMember) on JSON values without first validating that those values are objects. A malformed Discovery response whose data/service members or instances list contain non-object entries (e.g. a bare integer) triggers the RapidJSON object-access precondition on the client, reading memory out of bounds and potentially crashing the bRPC client.

Root Cause:
In src/brpc/policy/discovery_naming_service.cpp, DiscoveryNamingService::GetServers() and DiscoveryNames::ListDiscoveryNodes() access JSON values with member functions on non-object values. RapidJSON only defines these operations for object types; invoking them on a non-object violates the class invariant and results in undefined behavior (out-of-bounds read), commonly crashing the process.

Affected Scenarios: 
An operator-configured (or compromised) Discovery backend returns a malformed /discovery/nodes or /discovery/fetchs response whose data/service/instance entries are not JSON objects, crashing any bRPC client that refreshes its server list.

How to Fix:
1. Upgrade bRPC to version 1.18.0 or later, which fixes this issue.
2. Apply this patch: https://github.com/apache/brpc/pull/3533

The fix validates that the Discovery response data, per-service data, and instance entries are JSON objects (and skips non-object node/instance entries and rejects non-object data/service values) before calling member accessors.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_