Apache Avro Java SDK is Vulnerable to Code Injection
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas. This issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0. Users are recommended to upgrade to version 1.12.1 or 1.11.5, which fix the issue.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-33042US | — | — | ||
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas.
This issue affects Ap… | ||||
02
references
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2026/02/12/2WEB
- https://github.com/apache/avroPACKAGE
- https://github.com/apache/avro/commit/84bc7322ca1c04ab4a8e4e708acf1e271541aac4WEB
- https://github.com/apache/avro/pull/3150WEB
- https://github.com/pypa/advisory-database/tree/main/vulns/avro/PYSEC-2026-26.yamlWEB
- https://issues.apache.org/jira/browse/AVRO-4053WEB
- https://lists.apache.org/thread/fy88wmgf1lj9479vrpt12cv8x73lroj1WEB
- https://nvd.nist.gov/vuln/detail/CVE-2025-33042ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan