{"id":"CVE-2025-60021","published":"2026-01-16T08:39:23Z","modified":"2026-02-26T15:04:02Z","title":"Apache bRPC: Remote command injection vulnerability in heap builtin service","vendor":"Apache Software Foundation","product":"Apache bRPC","tier":"core","eol":null,"affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache bRPC","versions":[">= 1.11.0, < 1.15.0"]}],"description":{"text":"Remote command injection vulnerability in heap profiler builtin service in Apache bRPC ((all versions < 1.15.0)) on all platforms allows attacker to inject remote command.\n\n\n\nRoot Cause: The bRPC heap profiler built-in service (/pprof/heap) does not validate the user-provided extra_options parameter and executes it as a command-line argument. Attackers can execute remote commands using the extra_options parameter..\n\nAffected scenarios: Use the built-in bRPC heap profiler service to perform jemalloc memory profiling.\n\nHow to Fix: we provide two methods, you can choose one of them:\n\n1. Upgrade bRPC to version 1.15.0.\n2. Apply this patch ( https://github.com/apache/brpc/pull/3101 ) manually.","provenance":"source","from":"CVE.org"},"summary":{"text":"Apache bRPC (all versions before 1.15.0) contains a command injection flaw in the heap profiler built-in service at /pprof/heap, which fails to validate the user-supplied extra_options parameter before passing it as a command-line argument. An attacker with network access can inject arbitrary commands through that parameter on any platform, requiring no authentication or user interaction, provided the heap profiler service is in use for jemalloc memory profiling.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:20Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.25519,"percentile":0.97949,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-05-01","exploitedFirstSeen":"2026-05-01","ransomware":true,"evidence":[{"url":"https://ctrlaltintel.com/research/Qilin/","date":"2026-05-01"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-77","name":"Improper Neutralization of Special Elements used in a Command"}],"references":[{"url":"https://lists.apache.org/thread/xy51d2fx6drzhfp92xptsx5845q7b37m","tags":["vendor-advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/01/16/4","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-2933","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-2933","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2026-01-25","earliestUrl":"https://github.com/Mefhika120/Ashwesker-CVE-2025-60021","repos":[{"name":"Mefhika120/Ashwesker-CVE-2025-60021","url":"https://github.com/Mefhika120/Ashwesker-CVE-2025-60021","stars":0,"created":"2026-01-25"}]},"first":{"date":"2026-01-25","source":"PoC-in-GitHub","url":"https://github.com/Mefhika120/Ashwesker-CVE-2025-60021"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-01-16","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-60021","provenance":"source"},{"date":"2026-01-25","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/Mefhika120/Ashwesker-CVE-2025-60021","provenance":"source"},{"date":"2026-05-01","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://ctrlaltintel.com/research/Qilin/","provenance":"source"}],"speed":{"daysToPublicExploit":9,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":81.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 182 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.59,"detail":"percentile 0.9795"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}