9.2 Critical

CVE-2024-47561 Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code

Description

Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code. Users are recommended to upgrade to version 1.11.4 or 1.12.0, which fix this issue.

Affected products and versions

Product	Affected versions	Fixed in
Apache Avro Java SDK 1.11	earliest → < 1.11.4	1.11.4
avro 1.11	earliest → < 1.11.4	1.11.4

References

lists.apache.org lists.apache.org

Timeline

Published October 3, 2024
Last modified October 21, 2024

The 3 CVEs of Apache Avro Java SDK →

CVE-2025-33042 Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific… Not rated CVE-2023-39410 When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed… Not rated

Track this CVE

CVE-2024-47561 Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code

Description

Affected products and versions

References

Timeline

Other CVEs of Apache Avro Java SDK