Description
The Discovery naming-service reply parser in Apache bRPC (versions < 1.18.0) calls RapidJSON object-only accessors (FindMember) on JSON values without first validating that those values are objects. A malformed Discovery response whose data/service members or instances list contain non-object entries (e.g. a bare integer) triggers the RapidJSON object-access precondition on the client, reading memory out of bounds and potentially crashing the bRPC client.

Root Cause:
In src/brpc/policy/discovery_naming_service.cpp, DiscoveryNamingService::GetServers() and DiscoveryNames::ListDiscoveryNodes() access JSON values with member functions on non-object values. RapidJSON only defines these operations for object types; invoking them on a non-object violates the class invariant and results in undefined behavior (out-of-bounds read), commonly crashing the process.

Affected Scenarios:
An operator-configured (or compromised) Discovery backend returns a malformed /discovery/nodes or /discovery/fetchs response whose data/service/instance entries are not JSON objects, crashing any bRPC client that refreshes its server list.

How to Fix:
1. Upgrade bRPC to version 1.18.0 or later, which fixes this issue.
2. Apply this patch: https://github.com/apache/brpc/pull/3533

The fix validates that the Discovery response data, per-service data, and instance entries are JSON objects (and skips non-object node/instance entries and rejects non-object data/service values) before calling member accessors.
Published: 2026-10-21
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Out-of-bounds read leading to crash
Action: Patch
AI Analysis

Impact

The Discovery naming-service reply parser in Apache bRPC versions earlier than 1.18.0 incorrectly calls RapidJSON object member functions on values that are not objects. A crafted Discovery response that includes integers or other non‑object entries in the data/service or instance lists triggers an out‑of‑bounds read and can crash the bRPC client. The flaw does not directly reveal sensitive information but results in denial of service through application termination.

Affected Systems

All Apache bRPC releases before 1.18.0, such as 1.17.x and earlier, are affected when the client communicates with a discovery backend that is either operator configured or can be compromised. Any environment that relies on Apache bRPC for service discovery and has not applied the 1.18.0 update is vulnerable.

Risk and Exploitability

An attacker who controls or can influence the discovery backend can send malformed JSON, causing the client to crash when it refreshes its server list. The flaw, labeled as a classic out‑of‑bounds read (CWE‑125), has a CVSS score of 4.3, reflecting its moderate impact. The EPSS score is less than 1% and the vulnerability is not listed in CISA’s KEV catalog, so the prevalence of exploitation is uncertain, but denial of service can still be significant in production deployments.

Generated by OpenCVE AI on October 26, 2026 at 15:47 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Apache bRPC to version 1.18.0 or newer, which includes the fix.
  • If an immediate upgrade is not possible, apply the patch from https://github.com/apache/brpc/pull/3533 to validate the JSON response before calling object member functions.
  • Ensure that only trusted discovery backends are used or add a validation layer that rejects non‑object entries in the discovery response.

Generated by OpenCVE AI on October 26, 2026 at 15:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache brpc
Vendors & Products Apache
Apache brpc

Wed, 21 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Description The Discovery naming-service reply parser in Apache bRPC (versions < 1.18.0) calls RapidJSON object-only accessors (FindMember) on JSON values without first validating that those values are objects. A malformed Discovery response whose data/service members or instances list contain non-object entries (e.g. a bare integer) triggers the RapidJSON object-access precondition on the client, reading memory out of bounds and potentially crashing the bRPC client. Root Cause: In src/brpc/policy/discovery_naming_service.cpp, DiscoveryNamingService::GetServers() and DiscoveryNames::ListDiscoveryNodes() access JSON values with member functions on non-object values. RapidJSON only defines these operations for object types; invoking them on a non-object violates the class invariant and results in undefined behavior (out-of-bounds read), commonly crashing the process. Affected Scenarios: An operator-configured (or compromised) Discovery backend returns a malformed /discovery/nodes or /discovery/fetchs response whose data/service/instance entries are not JSON objects, crashing any bRPC client that refreshes its server list. How to Fix: 1. Upgrade bRPC to version 1.18.0 or later, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3533 The fix validates that the Discovery response data, per-service data, and instance entries are JSON objects (and skips non-object node/instance entries and rejects non-object data/service values) before calling member accessors.
Title Apache bRPC: Out-of-bounds read via non-object fields in Discovery naming-service reply parsing
Weaknesses CWE-125
References

Subscriptions

Apache Brpc
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-26T13:54:40.137Z

Reserved: 2026-09-09T12:24:36.838Z

Link: CVE-2026-87849

cve-icon Vulnrichment

Updated: 2026-10-26T13:54:32.696Z

cve-icon NVD

Status : Deferred

Published: 2026-10-21T13:20:04.603

Modified: 2026-10-26T20:10:00.160

Link: CVE-2026-87849

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-26T16:00:18Z

Weaknesses