CVE-2025-60021

Apache bRPC versions prior to 1.15.0 contain a remote command injection flaw (CWE-77) in the built-in heap profiler service at the /pprof/heap endpoint. When the heap profiler service is used to perform jemalloc memory profiling, the user-supplied extra_options parameter is inserted into a command line without validation, allowing a remote, unauthenticated attacker to inject and run arbitrary operating-system commands. Successful exploitation yields remote code execution with the privileges of the bRPC process, with high impact on confidentiality, integrity, and availability (CVSS 3.1 9.8, network vector, no privileges or user interaction required). Only deployments running an affected version that expose the built-in heap profiler service and use it for jemalloc profiling are affected; all platforms are impacted. No public proof-of-concept, in-the-wild exploitation, or KEV listing is known, but EPSS assigns a 24.8% probability of exploitation within 30 days (98th percentile), so defenders should treat exploitation as reasonably likely.

What to do: Upgrade Apache bRPC to version 1.15.0, or manually apply the upstream patch from GitHub pull request apache/brpc#3101. Until patched, restrict network access to bRPC's built-in service ports and stop using or exposing the /pprof/heap heap profiler service for jemalloc memory profiling. Inventory deployments running bRPC versions below 1.15.0 and prioritize any that are internet-facing, given the elevated EPSS score.