{"id":"CVE-2025-60021","summary":"Apache bRPC: Remote command injection vulnerability in heap builtin service","details":"Remote command injection vulnerability in heap profiler builtin service in Apache bRPC ((all versions \u003c 1.15.0)) on all platforms allows attacker to inject remote command.\n\n\n\nRoot Cause: The bRPC heap profiler built-in service (/pprof/heap) does not validate the user-provided extra_options parameter and executes it as a command-line argument. Attackers can execute remote commands using the extra_options parameter..\n\nAffected scenarios: Use the built-in bRPC heap profiler service to perform jemalloc memory profiling.\n\nHow to Fix: we provide two methods, you can choose one of them:\n\n1. Upgrade bRPC to version 1.15.0.\n2. Apply this patch ( https://github.com/apache/brpc/pull/3101 ) manually.","modified":"2026-08-12T03:51:48.599285029Z","published":"2026-01-16T08:39:23.318Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"introduced":"1.11.0"},{"fixed":"1.15.0"}],"source":"AFFECTED_FIELD"}],"cna_assigner":"apache","cwe_ids":["CWE-77"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/60xxx/CVE-2025-60021.json"},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/01/16/4"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/60xxx/CVE-2025-60021.json"},{"type":"ADVISORY","url":"https://lists.apache.org/thread/xy51d2fx6drzhfp92xptsx5845q7b37m"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-60021"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apache/brpc","events":[{"introduced":"04d15c08506c4614e2c373662c53ba4ca7055945"},{"fixed":"50a9075de62f1d2b825b902acbfecfddb3d9f314"}],"database_specific":{"cpe":"cpe:2.3:a:apache:brpc:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.11.0"},{"fixed":"1.15.0"}],"source":"CPE_RANGE"}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-60021.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}