CVE-2024-47561

Apache Avro Java SDK: Arbitrary Code Execution when reading Avro schema (Java SDK)

9.2 CriticalFix available

Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code. Users are recommended to upgrade to version 1.11.4 or 1.12.0, which fix this issue.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

3.26%Up 3.2 points since Oct 4, 2024

What each source reports

CVE List Score used 9.2

Apache Avro Java SDK: Arbitrary Code Execution when reading Avro schema (Java SDK)

Record: CVE-2024-47561
CVSS 4.0: 9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-502
Updated: 2026-11-02

EUVDEUVD-2024-3126 9.2

Record: EUVD-2024-3126
CVSS 4.0: 9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-r7pg-v2c8-mfg3 9.3

Apache Avro Java SDK: Arbitrary Code Execution when reading Avro Data (Java SDK)

Record: GHSA-r7pg-v2c8-mfg3
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-502
Updated: 2026-11-02

NVD 9.2

Record: CVE-2024-47561
CVSS 4.0: 9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-502
Updated: 2026-11-02

OSV 9.2

Apache Avro Java SDK: Arbitrary Code Execution when reading Avro schema (Java SDK)

Record: CVE-2024-47561
CVSS 4.0: 9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness: CWE-502
Updated: 2026-11-02

OSVGHSA-r7pg-v2c8-mfg3 9.3

Apache Avro Java SDK: Arbitrary Code Execution when reading Avro Data (Java SDK)

Record: GHSA-r7pg-v2c8-mfg3
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-502
Updated: 2026-11-02

Show 15 moreShow less

OSVJLSEC-2026-1374 9.2

Apache Avro Java SDK: Arbitrary Code Execution when reading Avro Data (Java SDK)

Record: JLSEC-2026-1374
CVSS 4.0: 9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated: 2026-11-02

OSVOESA-2024-2227 7.3

avro security update

Apache Avro is a data serialization system.

Security Fix(es):

Record: OESA-2024-2227
CVSS 3.1: 7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated: 2026-11-02

OSVRHLW-2026-4051ab209e8865e6 9.2

Lightwell Security Advisory: avro-android 1.11.0.rhlw-00002

Red Hat Lightwell has released org.apache.avro:avro-android 1.11.0.rhlw-00002 with backported fixes for CVE-2023-39410 and CVE-2024-47561.

CVE-2023-39410: Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK

CVE-2024-47561: Apache Avro Java SDK: Arbitrary Code Execution when reading Avro schema (Java SDK)

This patched artifact is a drop-in replacement for org.apache.avro:avro-android 1.11.0 from Maven Central.

Record: RHLW-2026-4051ab209e8865e6
CVSS 4.0: 9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated: 2026-11-02

OSVRHLW-2026-41bd2185e6d22e15 9.2

Lightwell Security Advisory: avro 1.11.0.rhlw-00002

Red Hat Lightwell has released org.apache.avro:avro 1.11.0.rhlw-00002 with backported fixes for CVE-2023-39410 and CVE-2024-47561.

CVE-2023-39410: Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK

CVE-2024-47561: Apache Avro Java SDK: Arbitrary Code Execution when reading Avro schema (Java SDK)

This patched artifact is a drop-in replacement for org.apache.avro:avro 1.11.0 from Maven Central.

Record: RHLW-2026-41bd2185e6d22e15
CVSS 4.0: 9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated: 2026-11-02

OSVRHLW-2026-6dd67008e326a981 9.2

Lightwell Security Advisory: avro 1.9.2.rhlw-00002

Red Hat Lightwell has released org.apache.avro:avro 1.9.2.rhlw-00002 with backported fixes for CVE-2024-47561 and CVE-2025-33042.

CVE-2024-47561: Apache Avro Java SDK: Arbitrary Code Execution when reading Avro schema (Java SDK)

CVE-2025-33042: Apache Avro Java SDK: Code injection on Java generated code

This patched artifact is a drop-in replacement for org.apache.avro:avro 1.9.2 from Maven Central.

Record: RHLW-2026-6dd67008e326a981
CVSS 4.0: 9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated: 2026-11-02

OSVRHSA-2024:10207 9.8

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.11 Security update

Record: RHSA-2024:10207
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2024:10208 9.8

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.8 on RHEL 7 security update

Record: RHSA-2024:10208
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2024:7811 8.8

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4 Security update

Record: RHSA-2024:7811
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVROOT-APP-MAVEN-CVE-2024-47561 9.8

CVE-2024-47561 in io.root.org.apache.avro:avro - Patched by Root

Root has patched CVE-2024-47561 in the io.root.org.apache.avro:avro package for Root:Maven. Multiple fixed versions available.

Record: ROOT-APP-MAVEN-CVE-2024-47561
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVCLSA-2025-1765325273 No score

TuxCare security update for org.apache.avro (2 CVEs)

TuxCare rebuilt 23 org.apache.avro packages to address 2 CVEs. Fixed in 1.10.2-tuxcare.2.

Record: CLSA-2025-1765325273
Updated: 2026-11-02

OSVCLSA-2026-1774225177 No score

TuxCare security update for org.apache.avro:avro (1 CVE)

TuxCare rebuilt org.apache.avro:avro to address 1 CVE. Fixed in 1.11.3-tuxcare.1.

Record: CLSA-2026-1774225177
Updated: 2026-11-02

OSVCLSA-2026-1778633128 No score

TuxCare security update for org.apache.avro (3 CVEs)

TuxCare rebuilt 16 org.apache.avro packages to address 3 CVEs. Fixed in 1.7.6-tuxcare.1.

Record: CLSA-2026-1778633128
Updated: 2026-11-02

OSVCLSA-2026-1778633130 No score

TuxCare security update for org.apache.avro (3 CVEs)

TuxCare rebuilt 16 org.apache.avro packages to address 3 CVEs. Fixed in 1.7.7-tuxcare.1.

Record: CLSA-2026-1778633130
Updated: 2026-11-02

OSVCLSA-2026-1778719546 No score

TuxCare security update for org.apache.avro:avro (2 CVEs)

TuxCare rebuilt org.apache.avro:avro to address 2 CVEs. Fixed in 1.8.2-tuxcare.1.

Record: CLSA-2026-1778719546
Updated: 2026-11-02

OSVCLSA-2026-1780966325 No score

TuxCare security update for org.apache.avro:avro (1 CVE)

TuxCare rebuilt org.apache.avro:avro to address 1 CVE. Fixed in 1.11.0-tuxcare.2.

Record: CLSA-2026-1780966325
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.apache.avro:avro` Maven	before 1.11.4	1.11.4
`org.apache.avro:avro` TuxCare:Maven	1.10.2 up to 1.10.2-tuxcare.2, plus listed versions 1.10.2-tuxcare.1	1.10.2-tuxcare.2
`org.apache.avro:avro-archetypes-parent` TuxCare:Maven	1.10.2 up to 1.10.2-tuxcare.2, plus listed versions 1.10.2-tuxcare.1	1.10.2-tuxcare.2
`org.apache.avro:avro-codegen-test` TuxCare:Maven	1.10.2 up to 1.10.2-tuxcare.2, plus listed versions 1.10.2-tuxcare.1	1.10.2-tuxcare.2
`org.apache.avro:avro-compiler` TuxCare:Maven	1.10.2 up to 1.10.2-tuxcare.2, plus listed versions 1.10.2-tuxcare.1	1.10.2-tuxcare.2
`org.apache.avro:avro-grpc` TuxCare:Maven	1.10.2 up to 1.10.2-tuxcare.2, plus listed versions 1.10.2-tuxcare.1	1.10.2-tuxcare.2
`org.apache.avro:avro-integration-test` TuxCare:Maven	1.10.2 up to 1.10.2-tuxcare.2, plus listed versions 1.10.2-tuxcare.1	1.10.2-tuxcare.2
`org.apache.avro:avro-ipc` TuxCare:Maven	1.10.2 up to 1.10.2-tuxcare.2, plus listed versions 1.10.2-tuxcare.1	1.10.2-tuxcare.2
`org.apache.avro:avro-ipc-jetty` TuxCare:Maven	1.10.2 up to 1.10.2-tuxcare.2, plus listed versions 1.10.2-tuxcare.1	1.10.2-tuxcare.2
`org.apache.avro:avro-ipc-netty` TuxCare:Maven	1.10.2 up to 1.10.2-tuxcare.2, plus listed versions 1.10.2-tuxcare.1	1.10.2-tuxcare.2

Show 128 moreShow less

Affected packages
Package	Affected	Fixed
`org.apache.avro:avro-mapred` TuxCare:Maven	1.10.2 up to 1.10.2-tuxcare.2, plus listed versions 1.10.2-tuxcare.1	1.10.2-tuxcare.2
`org.apache.avro:avro-maven-plugin` TuxCare:Maven	1.10.2 up to 1.10.2-tuxcare.2, plus listed versions 1.10.2-tuxcare.1	1.10.2-tuxcare.2
`org.apache.avro:avro-parent` TuxCare:Maven	1.10.2 up to 1.10.2-tuxcare.2, plus listed versions 1.10.2-tuxcare.1	1.10.2-tuxcare.2
`org.apache.avro:avro-perf` TuxCare:Maven	1.10.2 up to 1.10.2-tuxcare.2, plus listed versions 1.10.2-tuxcare.1	1.10.2-tuxcare.2
`org.apache.avro:avro-protobuf` TuxCare:Maven	1.10.2 up to 1.10.2-tuxcare.2, plus listed versions 1.10.2-tuxcare.1	1.10.2-tuxcare.2
`org.apache.avro:avro-service-archetype` TuxCare:Maven	1.10.2 up to 1.10.2-tuxcare.2, plus listed versions 1.10.2-tuxcare.1	1.10.2-tuxcare.2
`org.apache.avro:avro-test-custom-conversions` TuxCare:Maven	1.10.2 up to 1.10.2-tuxcare.2, plus listed versions 1.10.2-tuxcare.1	1.10.2-tuxcare.2
`org.apache.avro:avro-thrift` TuxCare:Maven	1.10.2 up to 1.10.2-tuxcare.2, plus listed versions 1.10.2-tuxcare.1	1.10.2-tuxcare.2
`org.apache.avro:avro-tools` TuxCare:Maven	1.10.2 up to 1.10.2-tuxcare.2, plus listed versions 1.10.2-tuxcare.1	1.10.2-tuxcare.2
`org.apache.avro:avro-toplevel` TuxCare:Maven	1.10.2 up to 1.10.2-tuxcare.2, plus listed versions 1.10.2-tuxcare.1	1.10.2-tuxcare.2
`org.apache.avro:trevni-avro` TuxCare:Maven	1.10.2 up to 1.10.2-tuxcare.2, plus listed versions 1.10.2-tuxcare.1	1.10.2-tuxcare.2
`org.apache.avro:trevni-core` TuxCare:Maven	1.10.2 up to 1.10.2-tuxcare.2, plus listed versions 1.10.2-tuxcare.1	1.10.2-tuxcare.2
`org.apache.avro:trevni-doc` TuxCare:Maven	1.10.2 up to 1.10.2-tuxcare.2, plus listed versions 1.10.2-tuxcare.1	1.10.2-tuxcare.2
`org.apache.avro:trevni-java` TuxCare:Maven	1.10.2 up to 1.10.2-tuxcare.2, plus listed versions 1.10.2-tuxcare.1	1.10.2-tuxcare.2
`org.apache.avro:avro` TuxCare:Maven	1.11.3 up to 1.11.3-tuxcare.1	1.11.3-tuxcare.1
`org.apache.avro:avro` TuxCare:Maven	1.7.6 up to 1.7.6-tuxcare.1	1.7.6-tuxcare.1
`org.apache.avro:avro-archetypes-parent` TuxCare:Maven	1.7.6 up to 1.7.6-tuxcare.1	1.7.6-tuxcare.1
`org.apache.avro:avro-compiler` TuxCare:Maven	1.7.6 up to 1.7.6-tuxcare.1	1.7.6-tuxcare.1
`org.apache.avro:avro-ipc` TuxCare:Maven	1.7.6 up to 1.7.6-tuxcare.1	1.7.6-tuxcare.1
`org.apache.avro:avro-mapred` TuxCare:Maven	1.7.6 up to 1.7.6-tuxcare.1	1.7.6-tuxcare.1
`org.apache.avro:avro-maven-plugin` TuxCare:Maven	1.7.6 up to 1.7.6-tuxcare.1	1.7.6-tuxcare.1
`org.apache.avro:avro-parent` TuxCare:Maven	1.7.6 up to 1.7.6-tuxcare.1	1.7.6-tuxcare.1
`org.apache.avro:avro-protobuf` TuxCare:Maven	1.7.6 up to 1.7.6-tuxcare.1	1.7.6-tuxcare.1
`org.apache.avro:avro-service-archetype` TuxCare:Maven	1.7.6 up to 1.7.6-tuxcare.1	1.7.6-tuxcare.1
`org.apache.avro:avro-thrift` TuxCare:Maven	1.7.6 up to 1.7.6-tuxcare.1	1.7.6-tuxcare.1
`org.apache.avro:avro-tools` TuxCare:Maven	1.7.6 up to 1.7.6-tuxcare.1	1.7.6-tuxcare.1
`org.apache.avro:avro-toplevel` TuxCare:Maven	1.7.6 up to 1.7.6-tuxcare.1	1.7.6-tuxcare.1
`org.apache.avro:trevni-avro` TuxCare:Maven	1.7.6 up to 1.7.6-tuxcare.1	1.7.6-tuxcare.1
`org.apache.avro:trevni-core` TuxCare:Maven	1.7.6 up to 1.7.6-tuxcare.1	1.7.6-tuxcare.1
`org.apache.avro:trevni-doc` TuxCare:Maven	1.7.6 up to 1.7.6-tuxcare.1	1.7.6-tuxcare.1
`org.apache.avro:trevni-java` TuxCare:Maven	1.7.6 up to 1.7.6-tuxcare.1	1.7.6-tuxcare.1
`org.apache.avro:avro` TuxCare:Maven	1.7.7 up to 1.7.7-tuxcare.1	1.7.7-tuxcare.1
`org.apache.avro:avro-archetypes-parent` TuxCare:Maven	1.7.7 up to 1.7.7-tuxcare.1	1.7.7-tuxcare.1
`org.apache.avro:avro-compiler` TuxCare:Maven	1.7.7 up to 1.7.7-tuxcare.1	1.7.7-tuxcare.1
`org.apache.avro:avro-ipc` TuxCare:Maven	1.7.7 up to 1.7.7-tuxcare.1	1.7.7-tuxcare.1
`org.apache.avro:avro-mapred` TuxCare:Maven	1.7.7 up to 1.7.7-tuxcare.1	1.7.7-tuxcare.1
`org.apache.avro:avro-maven-plugin` TuxCare:Maven	1.7.7 up to 1.7.7-tuxcare.1	1.7.7-tuxcare.1
`org.apache.avro:avro-parent` TuxCare:Maven	1.7.7 up to 1.7.7-tuxcare.1	1.7.7-tuxcare.1
`org.apache.avro:avro-protobuf` TuxCare:Maven	1.7.7 up to 1.7.7-tuxcare.1	1.7.7-tuxcare.1
`org.apache.avro:avro-service-archetype` TuxCare:Maven	1.7.7 up to 1.7.7-tuxcare.1	1.7.7-tuxcare.1
`org.apache.avro:avro-thrift` TuxCare:Maven	1.7.7 up to 1.7.7-tuxcare.1	1.7.7-tuxcare.1
`org.apache.avro:avro-tools` TuxCare:Maven	1.7.7 up to 1.7.7-tuxcare.1	1.7.7-tuxcare.1
`org.apache.avro:avro-toplevel` TuxCare:Maven	1.7.7 up to 1.7.7-tuxcare.1	1.7.7-tuxcare.1
`org.apache.avro:trevni-avro` TuxCare:Maven	1.7.7 up to 1.7.7-tuxcare.1	1.7.7-tuxcare.1
`org.apache.avro:trevni-core` TuxCare:Maven	1.7.7 up to 1.7.7-tuxcare.1	1.7.7-tuxcare.1
`org.apache.avro:trevni-doc` TuxCare:Maven	1.7.7 up to 1.7.7-tuxcare.1	1.7.7-tuxcare.1
`org.apache.avro:trevni-java` TuxCare:Maven	1.7.7 up to 1.7.7-tuxcare.1	1.7.7-tuxcare.1
`org.apache.avro:avro` TuxCare:Maven	1.8.2 up to 1.8.2-tuxcare.1	1.8.2-tuxcare.1
`org.apache.avro:avro` TuxCare:Maven	1.11.0 up to 1.11.0-tuxcare.2, plus listed versions 1.11.0-tuxcare.1	1.11.0-tuxcare.2
`org.apache.avro:avro` Maven	before 1.11.4, plus listed versions 1.10.01.10.11.10.21.11.01.11.1 Show 27 moreShow less 1.11.21.11.31.4.01.4.11.5.01.5.11.5.21.5.31.5.41.6.01.6.11.6.21.6.31.7.01.7.11.7.21.7.31.7.41.7.51.7.61.7.71.8.01.8.11.8.21.9.01.9.11.9.2	1.11.4
`Avro_jll` Julia	All versions	None known
`avro` openEuler:22.03-LTS-SP4	before 1.10.2-6.oe2203sp4	1.10.2-6.oe2203sp4
`avro` openEuler:22.03-LTS-SP3	before 1.10.2-6.oe2203sp3	1.10.2-6.oe2203sp3
`avro` openEuler:20.03-LTS-SP4	before 1.10.2-6.oe2003sp4	1.10.2-6.oe2003sp4
`avro` openEuler:22.03-LTS-SP1	before 1.10.2-6.oe2203sp1	1.10.2-6.oe2203sp1
`avro` openEuler:24.03-LTS	before 1.10.2-6.oe2403	1.10.2-6.oe2403
`org.apache.avro:avro-android` Red Hat Lightwell:Maven	before 1.11.0.rhlw-00002, plus listed versions 1.11.0	1.11.0.rhlw-00002
`org.apache.avro:avro` Red Hat Lightwell:Maven	before 1.11.0.rhlw-00002, plus listed versions 1.10.01.10.11.10.21.11.01.4.0 Show 24 moreShow less 1.4.11.5.01.5.11.5.21.5.31.5.41.6.01.6.11.6.21.6.31.7.01.7.11.7.21.7.31.7.41.7.51.7.61.7.71.8.01.8.11.8.21.9.01.9.11.9.2	1.11.0.rhlw-00002
`org.apache.avro:avro` Red Hat Lightwell:Maven	before 1.9.2.rhlw-00002, plus listed versions 1.4.01.4.11.5.01.5.11.5.2 Show 20 moreShow less 1.5.31.5.41.6.01.6.11.6.21.6.31.7.01.7.11.7.21.7.31.7.41.7.51.7.61.7.71.8.01.8.11.8.21.9.01.9.11.9.2	1.9.2.rhlw-00002
`eap7-apache-cxf` Red Hat:jboss_enterprise_application_platform_eus:7.3::el7	before 0:3.4.10-1.SP1_redhat_00001.1.el7eap	0:3.4.10-1.SP1_redhat_00001.1.el7eap
`eap7-apache-cxf-rt` Red Hat:jboss_enterprise_application_platform_eus:7.3::el7	before 0:3.4.10-1.SP1_redhat_00001.1.el7eap	0:3.4.10-1.SP1_redhat_00001.1.el7eap
`eap7-apache-cxf-services` Red Hat:jboss_enterprise_application_platform_eus:7.3::el7	before 0:3.4.10-1.SP1_redhat_00001.1.el7eap	0:3.4.10-1.SP1_redhat_00001.1.el7eap
`eap7-apache-cxf-tools` Red Hat:jboss_enterprise_application_platform_eus:7.3::el7	before 0:3.4.10-1.SP1_redhat_00001.1.el7eap	0:3.4.10-1.SP1_redhat_00001.1.el7eap
`eap7-avro` Red Hat:jboss_enterprise_application_platform_eus:7.3::el7	before 0:1.7.6-8.redhat_00003.1.el7eap	0:1.7.6-8.redhat_00003.1.el7eap
`eap7-h2database` Red Hat:jboss_enterprise_application_platform_eus:7.3::el7	before 0:1.4.197-3.redhat_00004.1.el7eap	0:1.4.197-3.redhat_00004.1.el7eap
`eap7-jboss-annotations-api_1.3_spec` Red Hat:jboss_enterprise_application_platform_eus:7.3::el7	before 0:2.0.1-4.Final_redhat_00001.1.el7eap	0:2.0.1-4.Final_redhat_00001.1.el7eap
`eap7-jboss-marshalling` Red Hat:jboss_enterprise_application_platform_eus:7.3::el7	before 0:2.0.15-1.Final_redhat_00001.1.el7eap	0:2.0.15-1.Final_redhat_00001.1.el7eap
`eap7-jboss-marshalling-river` Red Hat:jboss_enterprise_application_platform_eus:7.3::el7	before 0:2.0.15-1.Final_redhat_00001.1.el7eap	0:2.0.15-1.Final_redhat_00001.1.el7eap
`eap7-jboss-server-migration` Red Hat:jboss_enterprise_application_platform_eus:7.3::el7	before 0:1.7.2-12.Final_redhat_00013.1.el7eap	0:1.7.2-12.Final_redhat_00013.1.el7eap
`eap7-jboss-server-migration-cli` Red Hat:jboss_enterprise_application_platform_eus:7.3::el7	before 0:1.7.2-12.Final_redhat_00013.1.el7eap	0:1.7.2-12.Final_redhat_00013.1.el7eap
`eap7-jboss-server-migration-core` Red Hat:jboss_enterprise_application_platform_eus:7.3::el7	before 0:1.7.2-12.Final_redhat_00013.1.el7eap	0:1.7.2-12.Final_redhat_00013.1.el7eap
`eap7-jboss-server-migration-eap6.4` Red Hat:jboss_enterprise_application_platform_eus:7.3::el7	before 0:1.7.2-12.Final_redhat_00013.1.el7eap	0:1.7.2-12.Final_redhat_00013.1.el7eap
`eap7-jboss-server-migration-eap6.4-to-eap7.3` Red Hat:jboss_enterprise_application_platform_eus:7.3::el7	before 0:1.7.2-12.Final_redhat_00013.1.el7eap	0:1.7.2-12.Final_redhat_00013.1.el7eap
`eap7-jboss-server-migration-eap7.0` Red Hat:jboss_enterprise_application_platform_eus:7.3::el7	before 0:1.7.2-12.Final_redhat_00013.1.el7eap	0:1.7.2-12.Final_redhat_00013.1.el7eap
`eap7-jboss-server-migration-eap7.1` Red Hat:jboss_enterprise_application_platform_eus:7.3::el7	before 0:1.7.2-12.Final_redhat_00013.1.el7eap	0:1.7.2-12.Final_redhat_00013.1.el7eap
`eap7-jboss-server-migration-eap7.2` Red Hat:jboss_enterprise_application_platform_eus:7.3::el7	before 0:1.7.2-12.Final_redhat_00013.1.el7eap	0:1.7.2-12.Final_redhat_00013.1.el7eap
`eap7-jboss-server-migration-eap7.2-to-eap7.3` Red Hat:jboss_enterprise_application_platform_eus:7.3::el7	before 0:1.7.2-12.Final_redhat_00013.1.el7eap	0:1.7.2-12.Final_redhat_00013.1.el7eap
`eap7-jboss-server-migration-eap7.3-server` Red Hat:jboss_enterprise_application_platform_eus:7.3::el7	before 0:1.7.2-12.Final_redhat_00013.1.el7eap	0:1.7.2-12.Final_redhat_00013.1.el7eap
`eap7-jboss-server-migration-wildfly10.0` Red Hat:jboss_enterprise_application_platform_eus:7.3::el7	before 0:1.7.2-12.Final_redhat_00013.1.el7eap	0:1.7.2-12.Final_redhat_00013.1.el7eap
`eap7-jboss-server-migration-wildfly10.1` Red Hat:jboss_enterprise_application_platform_eus:7.3::el7	before 0:1.7.2-12.Final_redhat_00013.1.el7eap	0:1.7.2-12.Final_redhat_00013.1.el7eap
`eap7-jboss-server-migration-wildfly11.0` Red Hat:jboss_enterprise_application_platform_eus:7.3::el7	before 0:1.7.2-12.Final_redhat_00013.1.el7eap	0:1.7.2-12.Final_redhat_00013.1.el7eap
`eap7-jboss-server-migration-wildfly12.0` Red Hat:jboss_enterprise_application_platform_eus:7.3::el7	before 0:1.7.2-12.Final_redhat_00013.1.el7eap	0:1.7.2-12.Final_redhat_00013.1.el7eap
`eap7-jboss-server-migration-wildfly13.0-server` Red Hat:jboss_enterprise_application_platform_eus:7.3::el7	before 0:1.7.2-12.Final_redhat_00013.1.el7eap	0:1.7.2-12.Final_redhat_00013.1.el7eap
`eap7-jboss-server-migration-wildfly14.0-server` Red Hat:jboss_enterprise_application_platform_eus:7.3::el7	before 0:1.7.2-12.Final_redhat_00013.1.el7eap	0:1.7.2-12.Final_redhat_00013.1.el7eap
`eap7-jboss-server-migration-wildfly15.0-server` Red Hat:jboss_enterprise_application_platform_eus:7.3::el7	before 0:1.7.2-12.Final_redhat_00013.1.el7eap	0:1.7.2-12.Final_redhat_00013.1.el7eap
`eap7-jboss-server-migration-wildfly16.0-server` Red Hat:jboss_enterprise_application_platform_eus:7.3::el7	before 0:1.7.2-12.Final_redhat_00013.1.el7eap	0:1.7.2-12.Final_redhat_00013.1.el7eap
`eap7-jboss-server-migration-wildfly17.0-server` Red Hat:jboss_enterprise_application_platform_eus:7.3::el7	before 0:1.7.2-12.Final_redhat_00013.1.el7eap	0:1.7.2-12.Final_redhat_00013.1.el7eap
`eap7-jboss-server-migration-wildfly18.0-server` Red Hat:jboss_enterprise_application_platform_eus:7.3::el7	before 0:1.7.2-12.Final_redhat_00013.1.el7eap	0:1.7.2-12.Final_redhat_00013.1.el7eap
`eap7-jboss-server-migration-wildfly8.2` Red Hat:jboss_enterprise_application_platform_eus:7.3::el7	before 0:1.7.2-12.Final_redhat_00013.1.el7eap	0:1.7.2-12.Final_redhat_00013.1.el7eap
`eap7-jboss-server-migration-wildfly9.0` Red Hat:jboss_enterprise_application_platform_eus:7.3::el7	before 0:1.7.2-12.Final_redhat_00013.1.el7eap	0:1.7.2-12.Final_redhat_00013.1.el7eap
`eap7-jboss-xnio-base` Red Hat:jboss_enterprise_application_platform_eus:7.3::el7	before 0:3.7.13-1.Final_redhat_00001.1.el7eap	0:3.7.13-1.Final_redhat_00001.1.el7eap
`eap7-log4j-jboss-logmanager` Red Hat:jboss_enterprise_application_platform_eus:7.3::el7	before 0:1.2.2-2.Final_redhat_00002.1.el7eap	0:1.2.2-2.Final_redhat_00002.1.el7eap
`eap7-wildfly` Red Hat:jboss_enterprise_application_platform_eus:7.3::el7	before 0:7.3.11-4.GA_redhat_00002.1.el7eap	0:7.3.11-4.GA_redhat_00002.1.el7eap
`eap7-wildfly-java-jdk11` Red Hat:jboss_enterprise_application_platform_eus:7.3::el7	before 0:7.3.11-4.GA_redhat_00002.1.el7eap	0:7.3.11-4.GA_redhat_00002.1.el7eap
`eap7-wildfly-java-jdk8` Red Hat:jboss_enterprise_application_platform_eus:7.3::el7	before 0:7.3.11-4.GA_redhat_00002.1.el7eap	0:7.3.11-4.GA_redhat_00002.1.el7eap
`eap7-wildfly-javadocs` Red Hat:jboss_enterprise_application_platform_eus:7.3::el7	before 0:7.3.11-4.GA_redhat_00002.1.el7eap	0:7.3.11-4.GA_redhat_00002.1.el7eap
`eap7-wildfly-modules` Red Hat:jboss_enterprise_application_platform_eus:7.3::el7	before 0:7.3.11-4.GA_redhat_00002.1.el7eap	0:7.3.11-4.GA_redhat_00002.1.el7eap
`eap7-wss4j` Red Hat:jboss_enterprise_application_platform_eus:7.3::el7	before 0:2.3.3-2.redhat_00001.1.el7eap	0:2.3.3-2.redhat_00001.1.el7eap
`eap7-wss4j-bindings` Red Hat:jboss_enterprise_application_platform_eus:7.3::el7	before 0:2.3.3-2.redhat_00001.1.el7eap	0:2.3.3-2.redhat_00001.1.el7eap
`eap7-wss4j-policy` Red Hat:jboss_enterprise_application_platform_eus:7.3::el7	before 0:2.3.3-2.redhat_00001.1.el7eap	0:2.3.3-2.redhat_00001.1.el7eap
`eap7-wss4j-ws-security-common` Red Hat:jboss_enterprise_application_platform_eus:7.3::el7	before 0:2.3.3-2.redhat_00001.1.el7eap	0:2.3.3-2.redhat_00001.1.el7eap
`eap7-wss4j-ws-security-dom` Red Hat:jboss_enterprise_application_platform_eus:7.3::el7	before 0:2.3.3-2.redhat_00001.1.el7eap	0:2.3.3-2.redhat_00001.1.el7eap
`eap7-wss4j-ws-security-policy-stax` Red Hat:jboss_enterprise_application_platform_eus:7.3::el7	before 0:2.3.3-2.redhat_00001.1.el7eap	0:2.3.3-2.redhat_00001.1.el7eap
`eap7-wss4j-ws-security-stax` Red Hat:jboss_enterprise_application_platform_eus:7.3::el7	before 0:2.3.3-2.redhat_00001.1.el7eap	0:2.3.3-2.redhat_00001.1.el7eap
`eap7-xalan-j2` Red Hat:jboss_enterprise_application_platform_eus:7.3::el7	before 0:2.7.1-38.redhat_00015.1.el7eap	0:2.7.1-38.redhat_00015.1.el7eap
`eap7-xml-security` Red Hat:jboss_enterprise_application_platform_eus:7.3::el7	before 0:2.2.3-2.redhat_00001.1.el7eap	0:2.2.3-2.redhat_00001.1.el7eap
`eap7-apache-cxf` Red Hat:jboss_enterprise_application_platform_eus:7.1::el7	before 0:3.1.16-3.SP1_redhat_00001.1.ep7.el7	0:3.1.16-3.SP1_redhat_00001.1.ep7.el7
`eap7-apache-cxf-rt` Red Hat:jboss_enterprise_application_platform_eus:7.1::el7	before 0:3.1.16-3.SP1_redhat_00001.1.ep7.el7	0:3.1.16-3.SP1_redhat_00001.1.ep7.el7
`eap7-apache-cxf-services` Red Hat:jboss_enterprise_application_platform_eus:7.1::el7	before 0:3.1.16-3.SP1_redhat_00001.1.ep7.el7	0:3.1.16-3.SP1_redhat_00001.1.ep7.el7
`eap7-apache-cxf-tools` Red Hat:jboss_enterprise_application_platform_eus:7.1::el7	before 0:3.1.16-3.SP1_redhat_00001.1.ep7.el7	0:3.1.16-3.SP1_redhat_00001.1.ep7.el7
`eap7-avro` Red Hat:jboss_enterprise_application_platform_eus:7.1::el7	before 0:1.7.6-2.redhat_00003.1.ep7.el7	0:1.7.6-2.redhat_00003.1.ep7.el7
`eap7-bouncycastle` Red Hat:jboss_enterprise_application_platform_eus:7.1::el7	before 0:1.68.0-1.redhat_00005.1.ep7.el7	0:1.68.0-1.redhat_00005.1.ep7.el7
`eap7-bouncycastle-mail` Red Hat:jboss_enterprise_application_platform_eus:7.1::el7	before 0:1.68.0-1.redhat_00005.1.ep7.el7	0:1.68.0-1.redhat_00005.1.ep7.el7
`eap7-bouncycastle-pkix` Red Hat:jboss_enterprise_application_platform_eus:7.1::el7	before 0:1.68.0-1.redhat_00005.1.ep7.el7	0:1.68.0-1.redhat_00005.1.ep7.el7
`eap7-bouncycastle-prov` Red Hat:jboss_enterprise_application_platform_eus:7.1::el7	before 0:1.68.0-1.redhat_00005.1.ep7.el7	0:1.68.0-1.redhat_00005.1.ep7.el7
`eap7-h2database` Red Hat:jboss_enterprise_application_platform_eus:7.1::el7	before 0:1.4.197-2.redhat_00005.1.ep7.el7	0:1.4.197-2.redhat_00005.1.ep7.el7
`eap7-jackson-databind` Red Hat:jboss_enterprise_application_platform_eus:7.1::el7	before 0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7	0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7
`eap7-jboss-marshalling` Red Hat:jboss_enterprise_application_platform_eus:7.1::el7	before 0:2.0.15-1.Final_redhat_00001.1.ep7.el7	0:2.0.15-1.Final_redhat_00001.1.ep7.el7
`eap7-jboss-marshalling-river` Red Hat:jboss_enterprise_application_platform_eus:7.1::el7	before 0:2.0.15-1.Final_redhat_00001.1.ep7.el7	0:2.0.15-1.Final_redhat_00001.1.ep7.el7
`eap7-jboss-xnio-base` Red Hat:jboss_enterprise_application_platform_eus:7.1::el7	before 0:3.5.10-1.Final_redhat_00001.1.ep7.el7	0:3.5.10-1.Final_redhat_00001.1.ep7.el7
`eap7-wildfly` Red Hat:jboss_enterprise_application_platform_eus:7.1::el7	before 0:7.1.8-2.GA_redhat_00002.1.ep7.el7	0:7.1.8-2.GA_redhat_00002.1.ep7.el7
`eap7-wildfly-modules` Red Hat:jboss_enterprise_application_platform_eus:7.1::el7	before 0:7.1.8-2.GA_redhat_00002.1.ep7.el7	0:7.1.8-2.GA_redhat_00002.1.ep7.el7
`eap7-xalan-j2` Red Hat:jboss_enterprise_application_platform_eus:7.1::el7	before 0:2.7.1-26.redhat_00015.1.ep7.el7	0:2.7.1-26.redhat_00015.1.ep7.el7
`eap7-avro` Red Hat:jboss_enterprise_application_platform:7.4::el7	before 0:1.11.4-1.redhat_00001.1.el7eap	0:1.11.4-1.redhat_00001.1.el7eap
`eap7-avro` Red Hat:jboss_enterprise_application_platform:7.4::el8	before 0:1.11.4-1.redhat_00001.1.el8eap	0:1.11.4-1.redhat_00001.1.el8eap
`eap7-avro` Red Hat:jboss_enterprise_application_platform:7.4::el9	before 0:1.11.4-1.redhat_00001.1.el9eap	0:1.11.4-1.redhat_00001.1.el9eap
`io.root.org.apache.avro:avro` Root:Maven	before 1.11.1-root.io.1	1.11.1-root.io.11.9.2-root.io.11.9.2-root.io.21.7.7-root.io.11.7.7-root.io.21.11.1-root.io.21.9.2-root.io.31.11.3-root.io.11.11.0-root.io.1
`org.apache.avro:avro` Root:Maven	before 1.7.7-aikido.2	1.7.7-aikido.21.11.1-aikido.21.9.2-aikido.31.11.3-aikido.11.11.0-aikido.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-47561 is a critical vulnerability (CVSS 9.2) in Apache Avro, published October 3, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.26%, the 88th percentile. Fixed in org.apache.avro:avro 1.11.4.

References

Show 109 moreShow less