Description
The Discovery naming-service reply parser in Apache bRPC (versions < 1.18.0) calls RapidJSON object-only accessors (FindMember) on JSON values without first validating that those values are objects. A malformed Discovery response whose data/service members or instances list contain non-object entries (e.g. a bare integer) triggers the RapidJSON object-access precondition on the client, reading memory out of bounds and potentially crashing the bRPC client.

Root Cause:
In src/brpc/policy/discovery_naming_service.cpp, DiscoveryNamingService::GetServers() and DiscoveryNames::ListDiscoveryNodes() access JSON values with member functions on non-object values. RapidJSON only defines these operations for object types; invoking them on a non-object violates the class invariant and results in undefined behavior (out-of-bounds read), commonly crashing the process.

Affected Scenarios:
An operator-configured (or compromised) Discovery backend returns a malformed /discovery/nodes or /discovery/fetchs response whose data/service/instance entries are not JSON objects, crashing any bRPC client that refreshes its server list.

How to Fix:
1. Upgrade bRPC to version 1.18.0 or later, which fixes this issue.
2. Apply this patch: https://github.com/apache/brpc/pull/3533

The fix validates that the Discovery response data, per-service data, and instance entries are JSON objects (and skips non-object node/instance entries and rejects non-object data/service values) before calling member accessors.
Published: 2026-10-21
Score: n/a
EPSS: n/a
KEV: No
Impact: Out-of-bounds read leading to crash
Action: Patch
AI Analysis

Impact

The Discovery naming-service reply parser in Apache bRPC versions earlier than 1.18.0 incorrectly calls RapidJSON object member functions on values that are not objects. A crafted Discovery response that includes integers or other non‑object entries in the data/service or instance lists triggers an out‑of‑bounds read and can crash the bRPC client. The flaw does not directly reveal sensitive information but results in denial of service through application termination.

Affected Systems

All Apache bRPC releases before 1.18.0, such as 1.17.x and earlier, are affected when the client communicates with a discovery backend that is either operator configured or can be compromised. Any environment that relies on Apache bRPC for service discovery and has not applied the 1.18.0 update is vulnerable.

Risk and Exploitability

An attacker who controls or can influence the discovery backend can send malformed JSON, causing the client to crash when it refreshes its server list. Although no CVSS score is supplied, the weakness is a classic out‑of‑bounds read (CWE‑125) that reliably crashes the client. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, so the precise exploitation prevalence is unknown, but the impact on production systems can be substantial due to the denial of service effect.

Generated by OpenCVE AI on October 21, 2026 at 18:43 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Apache bRPC to version 1.18.0 or newer, which includes the fix.
  • If an immediate upgrade is not possible, apply the patch from https://github.com/apache/brpc/pull/3533 to validate the JSON response before calling object member functions.
  • Ensure that only trusted discovery backends are used or add a validation layer that rejects non‑object entries in the discovery response.

Generated by OpenCVE AI on October 21, 2026 at 18:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Description The Discovery naming-service reply parser in Apache bRPC (versions < 1.18.0) calls RapidJSON object-only accessors (FindMember) on JSON values without first validating that those values are objects. A malformed Discovery response whose data/service members or instances list contain non-object entries (e.g. a bare integer) triggers the RapidJSON object-access precondition on the client, reading memory out of bounds and potentially crashing the bRPC client. Root Cause: In src/brpc/policy/discovery_naming_service.cpp, DiscoveryNamingService::GetServers() and DiscoveryNames::ListDiscoveryNodes() access JSON values with member functions on non-object values. RapidJSON only defines these operations for object types; invoking them on a non-object violates the class invariant and results in undefined behavior (out-of-bounds read), commonly crashing the process. Affected Scenarios: An operator-configured (or compromised) Discovery backend returns a malformed /discovery/nodes or /discovery/fetchs response whose data/service/instance entries are not JSON objects, crashing any bRPC client that refreshes its server list. How to Fix: 1. Upgrade bRPC to version 1.18.0 or later, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3533 The fix validates that the Discovery response data, per-service data, and instance entries are JSON objects (and skips non-object node/instance entries and rejects non-object data/service values) before calling member accessors.
Title Apache bRPC: Out-of-bounds read via non-object fields in Discovery naming-service reply parsing
Weaknesses CWE-125
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-21T12:18:29.706Z

Reserved: 2026-09-09T12:24:36.838Z

Link: CVE-2026-87849

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-21T13:20:04.603

Modified: 2026-10-21T13:20:04.603

Link: CVE-2026-87849

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T18:45:07Z

Weaknesses