Memory Access Vulnerability in Apache bRPC Affecting Discovery Service

CVE-2026-87849

What is CVE-2026-87849?

A vulnerability exists in the Discovery naming-service of Apache bRPC, where the parser does not validate JSON values before accessing them. This can lead to an out-of-bounds memory read and potentially crash the bRPC client when it interacts with a malformed response from a compromised or misconfigured Discovery backend. The issue arises when non-object entries, such as bare integers, are present in the response data/service members list, resulting in undefined behavior. To mitigate this vulnerability, users are advised to upgrade to bRPC version 1.18.0 or later, which includes fixes for these validation issues, ensuring that all data entries are valid JSON objects.

References