Apache Avro Java SDK is Vulnerable to Code Injection
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas. This issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0. Users are recommended to upgrade to version 1.12.1 or 1.11.5, which fix the issue.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-33042US | — | — | ||
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas.
This issue affects Ap… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://www.openwall.com/lists/oss-security/2026/02/12/2WEB
- https://github.com/apache/avroPACKAGE
- https://github.com/apache/avro/commit/84bc7322ca1c04ab4a8e4e708acf1e271541aac4WEB
- https://github.com/apache/avro/pull/3150WEB
- https://github.com/pypa/advisory-database/tree/main/vulns/avro/PYSEC-2026-26.yamlWEB
- https://issues.apache.org/jira/browse/AVRO-4053WEB
- https://lists.apache.org/thread/fy88wmgf1lj9479vrpt12cv8x73lroj1WEB
- https://nvd.nist.gov/vuln/detail/CVE-2025-33042ADVISORY
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan