Skip to content
fr Sign in
Not rated

CVE-2025-33042 Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific…

Description

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas. This issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0. Users are recommended to upgrade to version 1.12.1 or 1.11.5, which fix the issue.

Affected products and versions

Product Affected versions Fixed in
Apache Avro Java SDK 1.12.0 No fix stated
Apache Avro Java SDK 1.11 earliest → 1.11.4 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Apache Avro Java SDK

The 3 CVEs of Apache Avro Java SDK →
CVE-2024-47561 Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code 9.2 Critical CVE-2023-39410 When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed… Not rated
Track this CVE