CVE-2025-60021 Apache bRPC: Remote command injection vulnerability in heap builtin service
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2025-60021?
CVE-2025-60021 is a critical vulnerability in Apache bRPC, published on 16 Jan 2026.
Official description
Remote command injection vulnerability in heap profiler builtin service in Apache bRPC ((all versions < 1.15.0)) on all platforms allows attacker to inject remote command.
Root Cause: The bRPC heap profiler built-in service (/pprof/heap) does not validate the user-provided extra_options parameter and executes it as a command-line argument. Attackers can execute remote commands using the extra_options parameter..
Affected scenarios: Use the built-in bRPC heap profiler service to perform jemalloc memory profiling.
How to Fix: we provide two methods, you can choose one of them:
1. Upgrade bRPC to version 1.15.0. 2. Apply this patch ( https://github.com/apache/brpc/pull/3101 ) manually.
Weakness: CWE-77
Which versions are affected by CVE-2025-60021?
It affects 1 product.
Products include Apache Brpc.
How do I fix CVE-2025-60021?
No fix has been published for CVE-2025-60021 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-60021 being exploited?
There is no known exploitation of CVE-2025-60021 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Apache bRPC
- CVE-2023-31039 Apache bRPC: ServerOptions.pid_file may cause arbitrary code execution
- CVE-2025-59789 Apache bRPC: Stack Exhaustion via Unbounded Recursion in JSON Parser
- CVE-2025-54472 Apache bRPC: Redis Parser Remote Denial of Service
- CVE-2024-23452 Apache bRPC: HTTP request smuggling vulnerability
- CVE-2023-45757 Apache bRPC: The builtin service rpcz page has an XSS attack vulnerability
Sources
Also known as GHSA-v93j-9rf6-jx2r.