GitHub Advisoryadvisory · Maven

GHSA-rp46-r563-jrc7 Apache Avro Java SDK is Vulnerable to Code Injection

MEDIUM Published 2026-02-13 Modified 2026-06-05 Official page ↗
Aliases
CVE-2025-33042
Ecosystem
Maven
Packages
org.apache.avro:avro-compiler
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-94
Reviewed
2026-02-13

Affected packages

• Maven org.apache.avro:avro-compiler: >= 1.12.0, < 1.12.1 → fixed in 1.12.1 • Maven org.apache.avro:avro-compiler: < 1.11.5 → fixed in 1.11.5

Description

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas. This issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0. Users are recommended to upgrade to version 1.12.1 or 1.11.5, which fix the issue.

Related

Alias · CVE (1)

  • CVE-2025-33042 Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from… vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References