org.apache.avro/avro vulnerabilities

Latest org.apache.avro/avro CVEs

Newest publication first

1. CVE-2025-33042 Apache Avro Java SDK: Code injection on Java generated code

   Published 2026-02-13

   High·CVSS 7.3 EPSS 0.63%

   Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas. This issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0. Users are recommended to upgrade...

2. CVE-2024-47561 Apache Avro Java SDK: Arbitrary Code Execution when reading Avro schema (Java SDK)

   Published 2024-10-03

   Critical·CVSS 9.2 EPSS 3.3%

   Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code. Users are recommended to upgrade to version 1.11.4 or 1.12.0, which fix this issue.

3. CVE-2023-39410 Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK

   Published 2023-09-29

   High·CVSS 7.5 EPSS 2.2%

   When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system. This issue affects Java applications using Apache Avro Java SDK up to and including 1.11.2. Users should upda...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.