Apache Brpc vulnerabilities

6 CVEs affecting Apache Brpc, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-60021, published 2026-01-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-60021, published 2026-01-16. Critical severity, CVSS 9.8. EPSS: 25.5% chance of exploitation in the next 30 days. Remote command injection vulnerability in heap profiler builtin service in Apache bRPC ((all versions < 1.15.0)) on all platforms allows attacker to inject remote command. Root Cause: The bRPC…
CVE-2024-23452, published 2024-02-08. High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days. Request smuggling vulnerability in HTTP server in Apache bRPC 0.9.5~1.7.0 on all platforms allows attacker to smuggle request. Vulnerability Cause Description： The http_parser does not comply with…
CVE-2025-59789, published 2025-12-01. High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days. Uncontrolled recursion in the json2pb component in Apache bRPC (version < 1.15.0) on all platforms allows remote attackers to make the server crash via sending deep recursive json data. Root…
CVE-2023-31039, published 2023-05-08. Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days. Security vulnerability in Apache bRPC <1.5.0 on all platforms allows attackers to execute arbitrary code via ServerOptions::pid_file. An attacker that can influence the ServerOptions pid_file…
CVE-2025-54472, published 2025-08-14. High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days. Unlimited memory allocation in redis protocol parser in Apache bRPC (all versions < 1.14.1) on all platforms allows attackers to crash the service via network. Root Cause: In the bRPC Redis…
CVE-2023-45757, published 2023-10-16. Medium severity, CVSS 6.1. EPSS: 1.2% chance of exploitation in the next 30 days. Security vulnerability in Apache bRPC <=1.6.0 on all platforms allows attackers to inject XSS code to the builtin rpcz page. An attacker that can send http request to bRPC server with rpcz enabled…