CVE-2025-59789

Published Dec 1, 2025

Last updated 3 days ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-59689 is a command injection vulnerability affecting Libraesva Email Security Gateway (ESG) appliances. It stems from improper sanitization during the removal of active code from files within certain compressed archive formats. An attacker can exploit this vulnerability by sending a specially crafted email with a compressed attachment to a vulnerable Libraesva ESG appliance. When the appliance processes the attachment, malicious commands embedded within the compressed file are executed, allowing the attacker to run arbitrary shell commands as a non-privileged user.

Description: Uncontrolled recursion in the json2pb component in Apache bRPC (version < 1.15.0) on all platforms allows remote attackers to make the server crash via sending deep recursive json data. Root Cause: The bRPC json2pb component uses rapidjson to parse json data from the network. The rapidjson parser uses a recursive parsing method by default. If the input json has a large depth of recursive structure, the parser function may run into stack overflow. Affected Scenarios: Use bRPC server with protobuf message to serve http+json requests from untrusted network. Or directly use JsonToProtoMessage to convert json from untrusted input. How to Fix: (Choose one of the following options) 1. Upgrade bRPC to version 1.15.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3099 Note: No matter which option you choose, you should know that the fix introduces a recursion depth limit with default value 100. It affects these functions: ProtoMessageToJson, ProtoMessageToProtoJson, JsonToProtoMessage, and ProtoJsonToProtoMessage. If your requests contain json or protobuf messages that have a depth exceeding the limit, the request will be failed after applying the fix. You can modify the gflag json2pb_max_recursion_depth to change the limit.
Source: security@apache.org
NVD status: Analyzed
Products: brpc

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity: HIGH

Weaknesses

security@apache.org: CWE-674

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:apache:brpc:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "8FC82429-4B83-4132-A67A-146ABA8A0F27",
            "versionEndExcluding": "1.15.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.