Description
Remote command injection vulnerability in heap profiler builtin service in Apache bRPC ((all versions < 1.15.0)) on all platforms allows attacker to inject remote command. Root Cause: The bRPC heap profiler built-in service (/pprof/heap) does not validate the user-provided extra_options parameter and executes it as a command-line argument. Attackers can execute remote commands using the extra_options parameter.. Affected scenarios: Use the built-in bRPC heap profiler service to perform jemalloc memory profiling. How to Fix: we provide two methods, you can choose one of them: 1. Upgrade bRPC to version 1.15.0. 2. Apply this patch ( https://github.com/apache/brpc/pull/3101 ) manually.
INFO
Published Date :
2026-01-16T08:39:23.318Z
Last Modified :
2026-01-17T04:55:14.838Z
Source :
apache
AFFECTED PRODUCTS
The following products are affected by CVE-2025-60021 vulnerability.
| Vendors | Products |
|---|---|
| Apache |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2025-60021.
