CVE-2026-87849 Apache Software Foundation CVE debrief

Who should care

Defenders of Apache bRPC deployments should assess exposure and prioritize upgrading to version 1.18.0 or later. They should also review and validate server configurations, monitor for suspicious activity, and verify the vulnerability details. This includes checking relevant monitoring, detection, and logs for exposed assets that need extra review.

Why it matters

CVE-2026-87849 allows for out-of-bounds reads in Apache bRPC. Defenders should assess exposure, prioritize upgrading, and monitor for suspicious activity.

• Potential crashes of bRPC clients
• Out-of-bounds reads via malformed Discovery replies
• Verification of server configurations required
• Upgrade to 1.18.0 or later recommended

Technical summary

The Discovery naming-service reply parser in Apache bRPC (versions < 1.18.0) calls RapidJSON object-only accessors on JSON values without first validating that those values are objects. A malformed Discovery response triggers the RapidJSON object-access precondition on the client, reading memory out of bounds and potentially crashing the bRPC client. The root cause lies in src/brpc/policy/discovery_naming_service.cpp, where DiscoveryNamingService::GetServers() and DiscoveryNames::ListDiscoveryNodes() access JSON values with member functions on non-object values. This can lead to out-of-bounds reads and potential crashes of bRPC clients.

Defensive priority

High

Recommended defensive actions

• Upgrade Apache bRPC to version 1.18.0 or later
• Review and validate server configurations
• Monitor for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the vulnerability. The NVD entry is currently being processed. There is limited information available on the specific affected scope and severity. Defenders should verify the vulnerability details and assess exposure. The CVE Program record and NVD detail page provide official information on the vulnerability. Supplemental sources may offer additional context.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.