A ready-made attack for a flaw in Apache Software Foundation Apache bRPC is now public
KROMSE explanation
Apache Software Foundation Apache bRPC has a security flaw (CVE-2025-60021). The official record says: Remote command injection vulnerability in heap profiler builtin service in Apache bRPC ((all versions < 1.15.0)) on all platforms allows attacker to inject remote command.
Not confirmed yet, but attack code is public, so attacks often follow within days.
Anyone running Apache Software Foundation Apache bRPC older than 1.15.0.
- Update Apache Software Foundation Apache bRPC to 1.15.0 or later.
- Not sure if you use it? KROMSE can check your product for free.
