CVE-2025-60021

Apache bRPC CVE-2025-60021 is a remote command injection in the heap profiler built-in service (/pprof/heap) affecting all versions

CVE-2023-31039

CVE-2023-31039 affects Apache bRPC prior to 1.5.0. The vulnerability arises from the ServerOptions::pid_file parameter, which, if influenced at startup, enables arbitrary code execution with the bRPC process permissions. Affected: brpc