CVE-2026-87849

Name of the Vulnerable Software and Affected Versions Apache bRPC versions prior to 1.18.0

Description The Discovery naming-service reply parser fails to validate that JSON values are objects before calling RapidJSON object-only accessors. A malformed response containing non-object entries in the data, service members, or instances list can trigger an out-of-bounds memory read, potentially crashing the client. This occurs within the DiscoveryNamingService::GetServers() and DiscoveryNames::ListDiscoveryNodes() functions in the src/brpc/policy/discovery naming service.cpp file. The issue can be triggered if a compromised or misconfigured Discovery backend returns malformed responses via the '/discovery/nodes' or '/discovery/fetchs' endpoints.

Recommendations Update Apache bRPC to version 1.18.0 or later.