{"id":"CVE-2025-60021","aliases":["EUVD-2026-2933","GHSA-v93j-9rf6-jx2r"],"status":"published","title":"Apache bRPC: Remote command injection vulnerability in heap builtin service","description":"Remote command injection vulnerability in heap profiler builtin service in Apache bRPC ((all versions \u003c 1.15.0)) on all platforms allows attacker to inject remote command.\n\n\n\nRoot Cause: The bRPC heap profiler built-in service (/pprof/heap) does not validate the user-provided extra_options parameter and executes it as a command-line argument. Attackers can execute remote commands using the extra_options parameter..\n\nAffected scenarios: Use the built-in bRPC heap profiler service to perform jemalloc memory profiling.\n\nHow to Fix: we provide two methods, you can choose one of them:\n\n1. Upgrade bRPC to version 1.15.0.\n2. Apply this patch ( https://github.com/apache/brpc/pull/3101 ) manually.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.25711,"percentile":0.97994,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-77"],"published":"2026-01-16T08:39:23Z","modified":"2026-10-28T02:30:47Z","exploits":[{"source":"pocgithub","id":"Mefhika120/Ashwesker-CVE-2025-60021","title":"Mefhika120/Ashwesker-CVE-2025-60021","date":"2026-01-25","url":"https://github.com/Mefhika120/Ashwesker-CVE-2025-60021"}],"products":[{"vendor":"apache","product":"brpc"},{"vendor":"apache software foundation","product":"apache brpc"}],"references":[{"url":"https://lists.apache.org/thread/xy51d2fx6drzhfp92xptsx5845q7b37m","tags":["vendor-advisory","Mailing List","Vendor Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/01/16/4","tags":["Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-60021","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-v93j-9rf6-jx2r"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/60xxx/CVE-2025-60021.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-60021","title":"Apache bRPC: Remote command injection vulnerability in heap builtin service","description":"Remote command injection vulnerability in heap profiler builtin service in Apache bRPC ((all versions \u003c 1.15.0)) on all platforms allows attacker to inject remote command.\n\n\n\nRoot Cause: The bRPC heap profiler built-in service (/pprof/heap) does not validate the user-provided extra_options parameter and executes it as a command-line argument. Attackers can execute remote commands using the extra_options parameter..\n\nAffected scenarios: Use the built-in bRPC heap profiler service to perform jemalloc memory profiling.\n\nHow to Fix: we provide two methods, you can choose one of them:\n\n1. Upgrade bRPC to version 1.15.0.\n2. Apply this patch ( https://github.com/apache/brpc/pull/3101 ) manually.","status":"published","published":"2026-01-16T08:39:23.318Z","modified":"2026-02-26T15:04:02.925Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:32:39.719629Z"}],"euvd":[{"id":"EUVD-2026-2933","description":"Remote command injection vulnerability in heap profiler builtin service in Apache bRPC ((all versions \u003c 1.15.0)) on all platforms allows attacker to inject remote command.\n\n\n\nRoot Cause: The bRPC heap profiler built-in service (/pprof/heap) does not validate the user-provided extra_options parameter and executes it as a command-line argument. Attackers can execute remote commands using the extra_options parameter..\n\nAffected scenarios: Use the built-in bRPC heap profiler service to perform jemalloc memory profiling.\n\nHow to Fix: we provide two methods, you can choose one of them:\n\n1. Upgrade bRPC to version 1.15.0.\n2. Apply this patch ( https://github.com/apache/brpc/pull/3101 ) manually.","status":"published","published":"2026-01-16T08:39:23Z","modified":"2026-02-26T15:04:02Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:48:27.038974Z"}],"ghsa":[{"id":"GHSA-v93j-9rf6-jx2r","title":"Remote command injection vulnerability in heap profiler builtin service in Apache bRPC ((all...","description":"Remote command injection vulnerability in heap profiler builtin service in Apache bRPC ((all versions \u003c 1.15.0)) on all platforms allows attacker to inject remote command.\n\n\n\nRoot Cause: The bRPC heap profiler built-in service (/pprof/heap) does not validate the user-provided extra_options parameter and executes it as a command-line argument. Attackers can execute remote commands using the extra_options parameter..\n\nAffected scenarios: Use the built-in bRPC heap profiler service to perform jemalloc memory profiling.\n\nHow to Fix: we provide two methods, you can choose one of them:\n\n1. Upgrade bRPC to version 1.15.0.\n2. Apply this patch ( https://github.com/apache/brpc/pull/3101 ) manually.","status":"published","published":"2026-01-16T09:31:21Z","modified":"2026-01-16T18:32:39Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T15:05:38.741943Z"}],"nvd":[{"id":"CVE-2025-60021","description":"Remote command injection vulnerability in heap profiler builtin service in Apache bRPC ((all versions \u003c 1.15.0)) on all platforms allows attacker to inject remote command.\n\n\n\nRoot Cause: The bRPC heap profiler built-in service (/pprof/heap) does not validate the user-provided extra_options parameter and executes it as a command-line argument. Attackers can execute remote commands using the extra_options parameter..\n\nAffected scenarios: Use the built-in bRPC heap profiler service to perform jemalloc memory profiling.\n\nHow to Fix: we provide two methods, you can choose one of them:\n\n1. Upgrade bRPC to version 1.15.0.\n2. Apply this patch ( https://github.com/apache/brpc/pull/3101 ) manually.","status":"published","published":"2026-01-16T09:16:03.127Z","modified":"2026-06-17T09:49:13.68Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:11:57.915063Z"}],"osv":[{"id":"CVE-2025-60021","title":"Apache bRPC: Remote command injection vulnerability in heap builtin service","description":"Remote command injection vulnerability in heap profiler builtin service in Apache bRPC ((all versions \u003c 1.15.0)) on all platforms allows attacker to inject remote command.\n\n\n\nRoot Cause: The bRPC heap profiler built-in service (/pprof/heap) does not validate the user-provided extra_options parameter and executes it as a command-line argument. Attackers can execute remote commands using the extra_options parameter..\n\nAffected scenarios: Use the built-in bRPC heap profiler service to perform jemalloc memory profiling.\n\nHow to Fix: we provide two methods, you can choose one of them:\n\n1. Upgrade bRPC to version 1.15.0.\n2. Apply this patch ( https://github.com/apache/brpc/pull/3101 ) manually.","status":"published","published":"2026-01-16T08:39:23.318Z","modified":"2026-10-28T02:30:47.335581646Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T15:44:51.516975Z"}]}}