Skip to main content

Github CVE-2025-60021

CRITICAL
Command Injection (CWE-77)
2026-01-16 security@apache.org
Apache Command Injection Github Brpc
9.8
CVSS 3.1
Share

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Mar 12, 2026 - 21:54 vuln.today
CVE Published
Jan 16, 2026 - 09:16 nvd
CRITICAL 9.8

DescriptionNVD

Remote command injection vulnerability in heap profiler builtin service in Apache bRPC ((all versions < 1.15.0)) on all platforms allows attacker to inject remote command.

Root Cause: The bRPC heap profiler built-in service (/pprof/heap) does not validate the user-provided extra_options parameter and executes it as a command-line argument. Attackers can execute remote commands using the extra_options parameter..

Affected scenarios: Use the built-in bRPC heap profiler service to perform jemalloc memory profiling.

How to Fix: we provide two methods, you can choose one of them:

  1. Upgrade bRPC to version 1.15.0.
  2. Apply this patch ( https://github.com/apache/brpc/pull/3101 ) manually.

AnalysisAI

Apache bRPC versions before 1.15.0 contain a remote command injection vulnerability in the heap profiler built-in service, allowing attackers to execute arbitrary OS commands.

Technical ContextAI

The built-in heap profiler service in Apache bRPC (all versions < 1.15.0) processes user input without proper sanitization (CWE-77), allowing injection of arbitrary OS commands through the profiling interface.

RemediationAI

Upgrade to Apache bRPC 1.15.0 or later. Disable built-in profiling services in production. Restrict access to debug endpoints.

More from same product – last 7 days

CVE-2025-48977 HIGH
8.5 May 28

Path traversal in Apache Ignite 2.0.0 through 2.17.0 lets authenticated REST API users read arbitrary files on the serve
CVE-2026-42782 HIGH
7.2 May 25

Code execution via Groovy sandbox bypass in Apache Syncope 3.0 through 3.0.16, 4.0 through 4.0.5, and 4.1.0 allows a hig
CVE-2026-43827 MEDIUM
5.9 May 25

Default configurations of Apache Shiro have a session fixation vulnerability. This issue affects Apache Shiro from 1.0

CVE-2026-43828 MEDIUM
5.9 May 25

Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute. This issue
CVE-2026-44598 MEDIUM
5.1 May 25

With valid login credentials, URL Redirection to Untrusted Site ('Open Redirect'), Server-Side Request Forgery (SSRF) vu

Share

CVE-2025-60021 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy