CVE-2026-87849: CWE-125 Out-of-bounds Read in Apache Software Foundation Apache bRPC

The vulnerability exists in the Discovery naming-service reply parser of Apache bRPC versions before 1.18.0. Specifically, functions GetServers() and ListDiscoveryNodes() access JSON values assuming they are objects, using RapidJSON's FindMember method without validation. If the Discovery backend returns malformed JSON responses where data, service, or instance entries are non-objects (e.g., integers), this leads to out-of-bounds memory reads and undefined behavior, typically causing client crashes. The issue is fixed in version 1.18.0 by adding validation to ensure JSON values are objects before accessing their members.

An attacker or misconfigured Discovery backend can cause any bRPC client that refreshes its server list to crash by returning malformed JSON responses with non-object entries. This results in denial of service for the client application relying on bRPC for service discovery.

Upgrade Apache bRPC to version 1.18.0 or later, which includes the fix validating JSON object types before member access. Alternatively, apply the patch available at https://github.com/apache/brpc/pull/3533. No other mitigation is required as the fix prevents out-of-bounds reads by skipping or rejecting non-object entries.