CVE-2025-60021: critical vulnerability in Apache bRPC
Apache bRPC: Remote command injection vulnerability in heap builtin service
Published · Updated
75Vexday Risk Score
Prioritize patching. It exploitation observed by VulnCheck and has a public proof of concept.
ssvc Actcvss 9.8epss 26%
from disclosure to weapon5 days
Published on NVDJan 16
1st PoC+5d
VulnCheck+105d
exploitation probability
26%top 2% of all CVEs
observed exploitation
yesVulnCheck
3 public exploit(s)
Remote command injection vulnerability in heap profiler builtin service in Apache bRPC ((all versions < 1.15.0)) on all platforms allows attacker to inject remote command.
Root Cause: The bRPC heap profiler built-in service (/pprof/heap) does not validate the user-provided extra_options parameter and executes it as a command-line argument. Attackers can execute remote commands using the extra_options parameter..
Affected scenarios: Use the built-in bRPC heap profiler service to perform jemalloc memory profiling.
How to Fix: we provide two methods, you can choose one of them:
1. Upgrade bRPC to version 1.15.0.
2. Apply this patch ( https://github.com/apache/brpc/pull/3101 ) manually.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Apache Software Foundation · Apache bRPCpublic PoCs found — 3
githubgithub.com/Mefhika120/Ashwesker-CVE-2025-60021★ 0vulncheckvulncheck.com/xdb/5f16a29bb3e8unverifiedvulncheckvulncheck.com/xdb/0a4f28845db5unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Apache bRPC
In the same product, most dangerous first.
CVE-2024-23452HIGHApache bRPC: HTTP request smuggling vulnerabilityEPSS 1.6%CVE-2025-59789HIGHApache bRPC: Stack Exhaustion via Unbounded Recursion in JSON ParserEPSS 1.6%CVE-2023-31039CRITICALApache bRPC: ServerOptions.pid_file may cause arbitrary code executionEPSS 1.5%CVE-2025-54472HIGHApache bRPC: Redis Parser Remote Denial of ServiceEPSS 1.3%CVE-2023-45757—Apache bRPC: The builtin service rpcz page has an XSS attack vulnerabilityEPSS 1.2%CVE-2026-56386HIGHApache bRPC: Integer Underflow and Out-of-Bounds Read in HTTP/2 DATA Frame ParserEPSS 0.7%