Is CVE-2026-87849 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-87849 being exploited in the wild.

How severe is CVE-2026-87849?

Informational severity, published 21 October 2026.

Is there a fix for CVE-2026-87849?

Yes: fixed in bRPC 1.18.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-87849 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-87849?

Check whether you run Apache Brpc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-87849: Apache bRPC Discovery naming-service JSON parsing crash

CVE-2026-87849 · Severity: info · Published 2026-10-21

Apache bRPC is a high-performance RPC framework used by many distributed systems. A malformed response from a Discovery service can crash any bRPC client that attempts to refresh its server list, potentially causing service outages. The vulnerability requires the Discovery backend to be misconfigured or compromised, making it a risk in environments where service discovery is not fully trusted.

Technologies: Apache Brpc. Vendors: Apache.

Quick answers

Is CVE-2026-87849 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-87849 being exploited in the wild.
How severe is CVE-2026-87849?: Informational severity, published 21 October 2026.
Which products and versions are affected?: Apache Brpc < 1.18.0.
Is there a fix for CVE-2026-87849?: Yes: fixed in bRPC 1.18.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-87849 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-87849?: Check whether you run Apache Brpc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: bRPC 1.18.0

Technical details

The DiscoveryNamingService parser in bRPC versions before 1.18.0 calls RapidJSON object-only member accessors (FindMember) on JSON values without first validating they are objects. A malicious or malformed Discovery response containing non-object entries (such as bare integers) in data, service, or instances fields triggers an out-of-bounds read in RapidJSON's precondition checks, crashing the client process. The fix validates JSON value types before invoking object accessors.

Affected products

Apache bRPC < 1.18.0

Timeline

2026-10-21: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.