CVE-2025-60021 in the critical feed json
Apache bRPC: Remote command injection vulnerability in heap builtin service
published 2026-01-16 9 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-2933
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 25.7%
- EPSS 25.7% chance of exploitation in 30 days, percentile 97%
- public exploits
- 0
- none known
Summary
Remote command injection vulnerability in heap profiler builtin service in Apache bRPC ((all versions < 1.15.0)) on all platforms allows attacker to inject remote command.
Root Cause: The bRPC heap profiler built-in service (/pprof/heap) does not validate the user-provided extra_options parameter and executes it as a command-line argument. Attackers can execute remote commands using the extra_options parameter..
Affected scenarios: Use the built-in bRPC heap profiler service to perform jemalloc memory profiling.
How to Fix: we provide two methods, you can choose one of them:
1. Upgrade bRPC to version 1.15.0. 2. Apply this patch ( https://github.com/apache/brpc/pull/3101 ) manually.
Patch / fix
- Apache Software Foundation Apache bRPC 1.15.0
Ransomware
Groups reported to have exploited it in intrusions.
- Qilin ransomware gang
reported by ctrlaltintel.com
Ransomware Vulnerability Matrix by BushidoUK (github.com/BushidoUK/Ransomware-Vulnerability-Matrix), reformatted per CVE. CC BY 4.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 9 mo ago
Exploit prediction
25.71% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- Apache Software Foundation Apache bRPC
Classification
- Weakness
-
- CWE-77 Improper Neutralization of Special Elements used in a Command
References
-
lists.apache.org
/thread/xy51d2fx6drzhfp92xptsx5845q7b37m
vendor-advisory, mailing-list
-
openwall.com
/lists/oss-security/2026/01/16/4
mailing-list, third-party-advisory
Sources
- CVE List CVE-2025-60021
- NVD CVE-2025-60021
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.