[<prev] [next>] [day] [month] [year] [list]
Message-ID: <5907213e-7239-31e7-3dc3-4733fdac2d96@apache.org>
Date: Fri, 16 Jan 2026 07:28:29 +0000
From: Guangming Chen <guangmingchen@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2025-60021: Apache bRPC: Remote command injection
vulnerability in heap builtin service
Severity: important
Affected versions:
- Apache bRPC 1.11.0 before 1.15.0
Description:
Remote command injection vulnerability in heap profiler builtin service in Apache bRPC ((all versions < 1.15.0)) on all platforms allows attacker to inject remote command.
Root Cause: The bRPC heap profiler built-in service (/pprof/heap) does not validate the user-provided extra_options parameter and executes it as a command-line argument. Attackers can execute remote commands using the extra_options parameter..
Affected scenarios: Use the built-in bRPC heap profiler service to perform jemalloc memory profiling.
How to Fix: we provide two methods, you can choose one of them:
1. Upgrade bRPC to version 1.15.0.
2. Apply this patch ( https://github.com/apache/brpc/pull/3101 ) manually.
Credit:
Simcha Kosman (reporter)
References:
https://brpc.apache.org
https://www.cve.org/CVERecord?id=CVE-2025-60021
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
