CVE-2025-60021: Apache bRPC Flaw Opens Door to Remote Command Injection

CVE-2025-60021 concerns Apache bRPC, an industrial‑grade C++ RPC framework whose heap profiler’s /pprof/heap endpoint contains a lack of input validation that can be exploited to execute remote commands. According to the advisory, the service does not validate the user-provided extra_options parameter and executes it as a command‑line argument, turning a debugging feature into a potential attack vector. The vulnerability is rated Important and affects Apache bRPC versions 1.11.0 up to, but not including, 1.15.0.

Upgrading to version 1.15.0 is the recommended fix, or, for those unable to upgrade immediately, applying a manual patch via the project’s GitHub repository (Pull Request #3101) is advised. Given bRPC’s use in high‑load, sensitive environments, this remote command injection poses a significant operational risk if left unpatched.