CVE-2026-87849: Apache bRPC: Out-of-bounds read via non-object fields in Discovery naming-service reply parsing
The Discovery naming-service reply parser in Apache bRPC (versions < 1.18.0) calls RapidJSON object-only accessors (FindMember) on JSON values without first validating that those values are objects. A malformed Discovery response whose data/service members or instances list contain non-object entries (e.g. a bare integer) triggers the RapidJSON object-access precondition on the client, reading memory out of bounds and potentially crashing the bRPC client.
Root Cause: In src/brpc/policy/discoverynamingservice.cpp, DiscoveryNamingService::GetServers() and DiscoveryNames::ListDiscoveryNodes() access JSON values with member functions on non-object values. RapidJSON only defines these operations for object types; invoking them on a non-object violates the class invariant and results in undefined behavior (out-of-bounds read), commonly crashing the process.
Affected Scenarios: An operator-configured (or compromised) Discovery backend returns a malformed /discovery/nodes or /discovery/fetchs response whose data/service/instance entries are not JSON objects, crashing any bRPC client that refreshes its server list.
How to Fix: 1. Upgrade bRPC to version 1.18.0 or later, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3533
The fix validates that the Discovery response data, per-service data, and instance entries are JSON objects (and skips non-object node/instance entries and rejects non-object data/service values) before calling member accessors.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache bRPCto a version that resolves this vulnerability.Fixed in 1.18.0
Event History
Frequently Asked Questions
Which deployments are exposed?
bRPC clients running versions earlier than 1.18.0 are exposed when they use a Discovery naming-service backend and refresh their server list from its /discovery/nodes or /discovery/fetchs responses.
What would an attacker need to trigger the issue?
They would need the Discovery backend to return a malformed response containing non-object JSON values where data, service, or instance entries are expected. This could occur through an operator-configured backend or a compromised Discovery backend.
What is the likely operational impact?
The malformed response can cause an out-of-bounds read in the client during reply parsing and commonly crashes the bRPC client process. The affected client is one that processes the malformed response while refreshing its server list.
How can I determine whether an environment needs remediation?
Check whether the deployed bRPC version is earlier than 1.18.0 and whether the client is configured to use the Discovery naming service. Also review the Discovery backend responses for entries that are not JSON objects in the relevant data, service, or instance fields.
What is the available fix?
Upgrade bRPC to version 1.18.0 or later, which fixes the parser behavior.