p PatchFirst

CVE-2025-33042

CVE-2025-33042 · Apache Avro Java SDK: Code injection on Java generated code

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas. This issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0. Users are recommended to upgrade to version 1.12.1 or 1.11.5, which fix the issue.

CVSS 7.3 · High · EPSS 0.7% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • apache avro java sdk

    Versions
    • ≥ 0, ≤ 1.11.4: Affected (semver)
    • 1.12.0: Affected (semver)

    No fix published

  • avro PyPI

    Versions
    • 1.10.0
    • 1.10.1
    • 1.10.2
    • 1.11.0
    • 1.11.1
    • 1.11.2
    • 1.11.3
    • 1.3.3
    • 1.4.1
    • 1.5.0
    • 1.5.1
    • 1.5.2
    • 1.5.3
    • 1.5.4
    • 1.6.0
    • 1.6.1
    • 1.6.2
    • 1.6.3
    • 1.7.0
    • 1.7.1
    • 1.7.2
    • 1.7.3
    • 1.7.4
    • 1.7.5
    • 1.7.6
    • 1.7.7
    • 1.8.0
    • 1.8.1
    • 1.8.2
    • 1.9.0
    • 1.9.1
    • 1.9.2
    Affected ranges
    • ECOSYSTEM: < 1.11.5

    Update to 1.11.5

Original sources

Check your server →