CVE-2025-33042
Apache Avro Java SDK: Code injection on Java generated code
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas.
This issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0.
Users are recommended to upgrade to version 1.12.1 or 1.11.5, which fix the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Apache Avro Java SDK: Code injection on Java generated code
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas.
This issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0.
Users are recommended to upgrade to version 1.12.1 or 1.11.5, which fix the issue.
- Record
CVE-2025-33042- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-94
- Updated
- 2026-11-02
EUVDEUVD-2025-206910
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas.
This issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0.
Users are recommended to upgrade to version 1.12.1 or 1.11.5, which fix the issue.
- Record
EUVD-2025-206910- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-rp46-r563-jrc7
Apache Avro Java SDK is Vulnerable to Code Injection
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas.
This issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0.
Users are recommended to upgrade to version 1.12.1 or 1.11.5, which fix the issue.
- Record
GHSA-rp46-r563-jrc7- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-94
- Updated
- 2026-11-02
NVD
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas.
This issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0.
Users are recommended to upgrade to version 1.12.1 or 1.11.5, which fix the issue.
- Record
CVE-2025-33042- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-94
- Updated
- 2026-11-02
OSV
Apache Avro Java SDK: Code injection on Java generated code
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas.
This issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0.
Users are recommended to upgrade to version 1.12.1 or 1.11.5, which fix the issue.
- Record
CVE-2025-33042- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-94
- Updated
- 2026-11-02
OSVGHSA-rp46-r563-jrc7
Apache Avro Java SDK is Vulnerable to Code Injection
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas.
This issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0.
Users are recommended to upgrade to version 1.12.1 or 1.11.5, which fix the issue.
- Record
GHSA-rp46-r563-jrc7- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-94
- Updated
- 2026-11-02
Show 10 moreShow less
OSVJLSEC-2026-1375
Apache Avro Java SDK is Vulnerable to Code Injection
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas.
This issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0.
Users are recommended to upgrade to version 1.12.1 or 1.11.5, which fix the issue.
- Record
JLSEC-2026-1375- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVPYSEC-2026-26
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas.
This issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0.
Users are recommended to upgrade to version 1.12.1 or 1.11.5, which fix the issue.
- Record
PYSEC-2026-26- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVRHLW-2026-6dd67008e326a981
Lightwell Security Advisory: avro 1.9.2.rhlw-00002
Red Hat Lightwell has released org.apache.avro:avro 1.9.2.rhlw-00002 with backported fixes for CVE-2024-47561 and CVE-2025-33042.
CVE-2024-47561: Apache Avro Java SDK: Arbitrary Code Execution when reading Avro schema (Java SDK)
CVE-2025-33042: Apache Avro Java SDK: Code injection on Java generated code
This patched artifact is a drop-in replacement for org.apache.avro:avro 1.9.2 from Maven Central.
- Record
RHLW-2026-6dd67008e326a981- CVSS 4.0
- 9.2 Critical
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
OSVRHLW-2026-9fa472b9239a3a7e
Lightwell Security Advisory: avro-compiler 1.9.2.rhlw-00002
Red Hat Lightwell has released org.apache.avro:avro-compiler 1.9.2.rhlw-00002 with a backported security fix.
CVE-2025-33042: Apache Avro Java SDK: Code injection on Java generated code
This patched artifact is a drop-in replacement for org.apache.avro:avro-compiler 1.9.2 from Maven Central.
- Record
RHLW-2026-9fa472b9239a3a7e- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVCLSA-2026-1786540164 No score
TuxCare security update for org.apache.avro:avro-compiler (1 CVE)
TuxCare rebuilt org.apache.avro:avro-compiler to address 1 CVE. Fixed in 1.10.2-tuxcare.4.
- Record
CLSA-2026-1786540164- Updated
- 2026-11-02
OSVCLSA-2026-1786540569 No score
TuxCare security update for org.apache.avro:avro-compiler (1 CVE)
TuxCare rebuilt org.apache.avro:avro-compiler to address 1 CVE. Fixed in 1.11.3-tuxcare.5.
- Record
CLSA-2026-1786540569- Updated
- 2026-11-02
OSVCLSA-2026-1786540745 No score
TuxCare security update for org.apache.avro:avro-compiler (1 CVE)
TuxCare rebuilt org.apache.avro:avro-compiler to address 1 CVE. Fixed in 1.11.0-tuxcare.3.
- Record
CLSA-2026-1786540745- Updated
- 2026-11-02
OSVCLSA-2026-1792063230 No score
TuxCare security update for org.apache.avro:avro-compiler (1 CVE)
TuxCare rebuilt org.apache.avro:avro-compiler to address 1 CVE. Fixed in 1.7.7-tuxcare.5.
- Record
CLSA-2026-1792063230- Updated
- 2026-11-02
OSVCLSA-2026-1792063313 No score
TuxCare security update for org.apache.avro:avro-compiler (1 CVE)
TuxCare rebuilt org.apache.avro:avro-compiler to address 1 CVE. Fixed in 1.7.6-tuxcare.5.
- Record
CLSA-2026-1792063313- Updated
- 2026-11-02
OSVCLSA-2026-1792663402 No score
TuxCare security update for org.apache.avro (2 CVEs)
TuxCare rebuilt 2 org.apache.avro packages to address 2 CVEs. Fixed in 1.9.2-tuxcare.1.
- Record
CLSA-2026-1792663402- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.avro:avro-compilerMaven |
1.12.0 to 1.12.0 | 1.12.1 |
org.apache.avro:avro-compilerMaven |
before 1.11.5 | 1.11.5 |
org.apache.avro:avro-compilerTuxCare:Maven |
1.10.2 up to 1.10.2-tuxcare.4, plus listed versions 1.10.2-tuxcare.11.10.2-tuxcare.21.10.2-tuxcare.3 |
1.10.2-tuxcare.4 |
org.apache.avro:avro-compilerTuxCare:Maven |
1.11.3 up to 1.11.3-tuxcare.5, plus listed versions 1.11.3-tuxcare.11.11.3-tuxcare.21.11.3-tuxcare.31.11.3-tuxcare.4 |
1.11.3-tuxcare.5 |
org.apache.avro:avro-compilerTuxCare:Maven |
1.11.0 up to 1.11.0-tuxcare.3, plus listed versions 1.11.0-tuxcare.11.11.0-tuxcare.2 |
1.11.0-tuxcare.3 |
org.apache.avro:avro-compilerTuxCare:Maven |
1.7.7 up to 1.7.7-tuxcare.5, plus listed versions 1.7.7-tuxcare.11.7.7-tuxcare.21.7.7-tuxcare.31.7.7-tuxcare.4 |
1.7.7-tuxcare.5 |
org.apache.avro:avro-compilerTuxCare:Maven |
1.7.6 up to 1.7.6-tuxcare.5, plus listed versions 1.7.6-tuxcare.11.7.6-tuxcare.21.7.6-tuxcare.31.7.6-tuxcare.4 |
1.7.6-tuxcare.5 |
org.apache.avro:avroTuxCare:Maven From an advisory covering 2 CVEs |
1.9.2 up to 1.9.2-tuxcare.1 | 1.9.2-tuxcare.1 |
org.apache.avro:avro-compilerTuxCare:Maven From an advisory covering 2 CVEs |
1.9.2 up to 1.9.2-tuxcare.1 | 1.9.2-tuxcare.1 |
org.apache.avro:avro-compilerMaven |
1.12.0 up to 1.12.1 | 1.12.1 |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.apache.avro:avro-compilerMaven |
before 1.11.5, plus listed versions 1.10.01.10.11.10.21.11.01.11.1 Show 26 moreShow less1.11.21.11.31.11.41.5.01.5.11.5.21.5.31.5.41.6.01.6.11.6.21.6.31.7.01.7.11.7.21.7.31.7.41.7.51.7.61.7.71.8.01.8.11.8.21.9.01.9.11.9.2 |
1.11.5 |
Avro_jllJulia |
All versions | None known |
avroPyPI |
before 1.11.5, plus listed versions 1.10.01.10.11.10.21.11.01.11.1 Show 27 moreShow less1.11.21.11.31.3.31.4.11.5.01.5.11.5.21.5.31.5.41.6.01.6.11.6.21.6.31.7.01.7.11.7.21.7.31.7.41.7.51.7.61.7.71.8.01.8.11.8.21.9.01.9.11.9.2 |
1.11.5 |
org.apache.avro:avroRed Hat Lightwell:Maven From an advisory covering 2 CVEs |
before 1.9.2.rhlw-00002, plus listed versions 1.4.01.4.11.5.01.5.11.5.2 Show 20 moreShow less1.5.31.5.41.6.01.6.11.6.21.6.31.7.01.7.11.7.21.7.31.7.41.7.51.7.61.7.71.8.01.8.11.8.21.9.01.9.11.9.2 |
1.9.2.rhlw-00002 |
org.apache.avro:avro-compilerRed Hat Lightwell:Maven |
before 1.9.2.rhlw-00002, plus listed versions 1.5.01.5.11.5.21.5.31.5.4 Show 18 moreShow less1.6.01.6.11.6.21.6.31.7.01.7.11.7.21.7.31.7.41.7.51.7.61.7.71.8.01.8.11.8.21.9.01.9.11.9.2 |
1.9.2.rhlw-00002 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-33042 is a high vulnerability (CVSS 7.3) in Apache Avro, published February 13, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.67%, the 52nd percentile. Fixed in org.apache.avro:avro-compiler 1.12.1.
References
lists.apache.org/thread/fy88wmgf1lj9479vrpt12cv8x73lroj1
openwall.com/lists/oss-security/2026/02/12/2
nvd.nist.gov/vuln/detail/CVE-2025-33042
github.com/apache/avro/pull/3150
issues.apache.org/jira/browse/AVRO-4053
Show 10 moreShow less
security.snyk.io/vuln/SNYK-JAVA-ORGAPACHEAVRO-15282783
repo.maven.apache.org/maven2