Read the docs
TI-2025-37397 Aliases CVE-2025-60021GHSA-v93j-9rf6-jx2r

Apache bRPC: Remote command injection vulnerability in heap builtin service

Priority MEDIUM 64CWE-77Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-77.

Summary

Remote command injection vulnerability in heap profiler builtin service in Apache bRPC ((all versions < 1.15.0)) on all platforms allows attacker to inject remote command. Root Cause: The bRPC heap profiler built-in service (/pprof/heap) does not validate the user-provided extra_options parameter and executes it as a command-line argument. Attackers can execute remote commands using the extra_options parameter.. Affected scenarios: Use the built-in bRPC heap profiler service to perform jemalloc memory profiling. How to Fix: we provide two methods, you can choose one of them: 1. Upgrade bRPC to version 1.15.0. 2. Apply this patch ( https://github.com/apache/brpc/pull/3101 ) manually.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.25711 97th percentileScored 2026-11-07
Fix Fixed Apache bRPC (Apache Software Foundation): 1.15.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache bRPC1.11.0 to before 1.15.01.15.0Patch availableCNA
  • Apache bRPC VendorApache Affected 1.11.0 to before 1.15.0 Fixed in 1.15.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:brpc:*:*:*:*:*:*:*:*1.11.0 to before 1.15.0VulnerableApache
  • cpe:2.3:a:apache:brpc:*:*:*:*:*:*:*:* Versions 1.11.0 to before 1.15.0 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache bRPC (Apache Software Foundation) Fixed in 1.15.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-60021
  2. 2026-10-03 Alias added: GHSA-v93j-9rf6-jx2r

References

Advisory 2

  • TI-2023-14776 Apache bRPC: ServerOptions.pid_file may cause arbitrary code execution CVSS 3.1CRITICAL 9.8
  • TI-2025-37239 Apache bRPC: Stack Exhaustion via Unbounded Recursion in JSON Parser CVSS 3.1HIGH 7.5
  • TI-2025-34269 Apache bRPC: Redis Parser Remote Denial of Service CVSS 3.1HIGH 7.5
  • TI-2024-15499 Apache bRPC: HTTP request smuggling vulnerability CVSS 3.1HIGH 7.5
  • TI-2023-24531 Apache bRPC: The builtin service rpcz page has an XSS attack vulnerability CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences