PYSEC-2026-26

vendorUSosv

view advisory published 2026-02-13Licence: CC-BY-4.0

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas. This issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0. Users are recommended to upgrade to version 1.12.1 or 1.11.5, which fix the issue.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-33042US	—	0.67% (52nd)	—	2026-02-13
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas. This issue affects Ap…

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2026/02/12/2ADVISORY
https://lists.apache.org/thread/fy88wmgf1lj9479vrpt12cv8x73lroj1REPORT

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan