Hello, this is Tibero.

A high-risk vulnerability (CVE-2025-60021) was recently announced in the open-source RPC framework Apache bRPC, which allows unauthenticated remote command execution. We understand that many customers may be wondering whether our products are affected.

Accordingly, we would like to provide the results of our investigation and information regarding product safety below.

Vulnerability Overview

• CVE Number: CVE-2025-60021

• Description: A flaw in the heap profiler service (/pprof/heap) of Apache bRPC caused by insufficient parameter validation, allowing unauthenticated users to execute remote code (RCE)

• Affected Versions: Apache bRPC versions 1.11.0 through 1.14.x

Results of the Tibero Product Impact Assessment

Following a detailed analysis by our research institute, we would like to inform you that all Tibero product families are safe from this vulnerability.

The service packages of all our product families do not include the Apache bRPC module, and therefore are not directly affected by or exposed to security threats resulting from this vulnerability.

Tibero will continue to monitor open-source security vulnerabilities and do its utmost to maintain the highest standards of security quality so that you can operate our products with confidence.
 

If you have any additional questions regarding this matter, please submit an inquiry through SR.

Thank you.