CVE-2025-60021

Published Jan 16, 2026

Last updated 4 days ago

Apache bRPC

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-60021 is identified as a remote command injection vulnerability affecting Apache bRPC, an industrial-grade C++ RPC framework. This flaw resides within the heap profiler built-in service, specifically impacting the `/pprof/heap` endpoint. The vulnerability stems from insufficient input validation, where the `extra_options` parameter, provided by the user, is executed as a command-line argument without proper sanitization. This oversight allows an attacker to inject and execute remote commands on the server. The affected versions of Apache bRPC are 1.11.0 through those prior to 1.15.0, across all platforms.

Description: Remote command injection vulnerability in heap profiler builtin service in Apache bRPC ((all versions < 1.15.0)) on all platforms allows attacker to inject remote command. Root Cause: The bRPC heap profiler built-in service (/pprof/heap) does not validate the user-provided extra_options parameter and executes it as a command-line argument. Attackers can execute remote commands using the extra_options parameter.. Affected scenarios: Use the built-in bRPC heap profiler service to perform jemalloc memory profiling. How to Fix: we provide two methods, you can choose one of them: 1. Upgrade bRPC to version 1.15.0. 2. Apply this patch ( https://github.com/apache/brpc/pull/3101 ) manually.
Source: security@apache.org
NVD status: Undergoing Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

security@apache.org: CWE-77

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 21

References