{"id":"CVE-2021-43045","aliases":["CLSA-2025-1765325273","CLSA-2026-1778633128","CLSA-2026-1778633130","CLSA-2026-1786345204","EUVD-2022-0519","GHSA-868x-rg4c-cjqg","OESA-2023-1950"],"status":"published","title":"Possible DOS vulnerabilities in C# Avro SDK","description":"A vulnerability in the .NET SDK of Apache Avro allows an attacker to allocate excessive resources, potentially causing a denial-of-service attack. This issue affects .NET applications using Apache Avro version 1.10.2 and prior versions. Users should update to version 1.11.0 which addresses this issue.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.03057,"percentile":0.87778,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2022-01-06T18:00:12Z","modified":"2026-10-24T10:30:18Z","fixes":[{"ecosystem":"NuGet","package":"Apache.Avro","fixed_in":["1.11.0"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro","fixed_in":["1.8.2-tuxcare.4"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-archetypes-parent","fixed_in":["1.8.2-tuxcare.4"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-compiler","fixed_in":["1.8.2-tuxcare.4"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-guava-dependencies","fixed_in":["1.8.2-tuxcare.4"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-ipc","fixed_in":["1.8.2-tuxcare.4"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-mapred","fixed_in":["1.8.2-tuxcare.4"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-maven-plugin","fixed_in":["1.8.2-tuxcare.4"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-parent","fixed_in":["1.8.2-tuxcare.4"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-protobuf","fixed_in":["1.8.2-tuxcare.4"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-service-archetype","fixed_in":["1.8.2-tuxcare.4"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-thrift","fixed_in":["1.8.2-tuxcare.4"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-tools","fixed_in":["1.8.2-tuxcare.4"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-toplevel","fixed_in":["1.8.2-tuxcare.4"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"org.apache.avro:trevni-avro","fixed_in":["1.8.2-tuxcare.4"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"org.apache.avro:trevni-core","fixed_in":["1.8.2-tuxcare.4"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"org.apache.avro:trevni-doc","fixed_in":["1.8.2-tuxcare.4"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"org.apache.avro:trevni-java","fixed_in":["1.8.2-tuxcare.4"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"avro","fixed_in":["1.10.2-4.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"avro","fixed_in":["1.10.2-4.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"avro","fixed_in":["1.10.2-4.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"avro","fixed_in":["1.10.2-4.oe2203sp2"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"avro","fixed_in":["1.10.2-4.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP2","package":"avro","fixed_in":["1.10.2-4.oe2203sp2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"Apache.Avro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.2"},{"fixed":"1.10.2-tuxcare.2"}]}],"versions":["1.10.2","1.10.2-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-archetypes-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.2"},{"fixed":"1.10.2-tuxcare.2"}]}],"versions":["1.10.2","1.10.2-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-codegen-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.2"},{"fixed":"1.10.2-tuxcare.2"}]}],"versions":["1.10.2","1.10.2-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-compiler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.2"},{"fixed":"1.10.2-tuxcare.2"}]}],"versions":["1.10.2","1.10.2-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-grpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.2"},{"fixed":"1.10.2-tuxcare.2"}]}],"versions":["1.10.2","1.10.2-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-integration-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.2"},{"fixed":"1.10.2-tuxcare.2"}]}],"versions":["1.10.2","1.10.2-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-ipc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.2"},{"fixed":"1.10.2-tuxcare.2"}]}],"versions":["1.10.2","1.10.2-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-ipc-jetty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.2"},{"fixed":"1.10.2-tuxcare.2"}]}],"versions":["1.10.2","1.10.2-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-ipc-netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.2"},{"fixed":"1.10.2-tuxcare.2"}]}],"versions":["1.10.2","1.10.2-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-mapred","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.2"},{"fixed":"1.10.2-tuxcare.2"}]}],"versions":["1.10.2","1.10.2-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-maven-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.2"},{"fixed":"1.10.2-tuxcare.2"}]}],"versions":["1.10.2","1.10.2-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.2"},{"fixed":"1.10.2-tuxcare.2"}]}],"versions":["1.10.2","1.10.2-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-perf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.2"},{"fixed":"1.10.2-tuxcare.2"}]}],"versions":["1.10.2","1.10.2-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.2"},{"fixed":"1.10.2-tuxcare.2"}]}],"versions":["1.10.2","1.10.2-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-service-archetype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.2"},{"fixed":"1.10.2-tuxcare.2"}]}],"versions":["1.10.2","1.10.2-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-test-custom-conversions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.2"},{"fixed":"1.10.2-tuxcare.2"}]}],"versions":["1.10.2","1.10.2-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-thrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.2"},{"fixed":"1.10.2-tuxcare.2"}]}],"versions":["1.10.2","1.10.2-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.2"},{"fixed":"1.10.2-tuxcare.2"}]}],"versions":["1.10.2","1.10.2-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-toplevel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.2"},{"fixed":"1.10.2-tuxcare.2"}]}],"versions":["1.10.2","1.10.2-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:trevni-avro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.2"},{"fixed":"1.10.2-tuxcare.2"}]}],"versions":["1.10.2","1.10.2-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:trevni-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.2"},{"fixed":"1.10.2-tuxcare.2"}]}],"versions":["1.10.2","1.10.2-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:trevni-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.2"},{"fixed":"1.10.2-tuxcare.2"}]}],"versions":["1.10.2","1.10.2-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:trevni-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.2"},{"fixed":"1.10.2-tuxcare.2"}]}],"versions":["1.10.2","1.10.2-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.6"},{"fixed":"1.7.6-tuxcare.1"}]}],"versions":["1.7.6"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-archetypes-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.6"},{"fixed":"1.7.6-tuxcare.1"}]}],"versions":["1.7.6"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-compiler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.6"},{"fixed":"1.7.6-tuxcare.1"}]}],"versions":["1.7.6"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-ipc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.6"},{"fixed":"1.7.6-tuxcare.1"}]}],"versions":["1.7.6"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-mapred","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.6"},{"fixed":"1.7.6-tuxcare.1"}]}],"versions":["1.7.6"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-maven-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.6"},{"fixed":"1.7.6-tuxcare.1"}]}],"versions":["1.7.6"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.6"},{"fixed":"1.7.6-tuxcare.1"}]}],"versions":["1.7.6"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.6"},{"fixed":"1.7.6-tuxcare.1"}]}],"versions":["1.7.6"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-service-archetype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.6"},{"fixed":"1.7.6-tuxcare.1"}]}],"versions":["1.7.6"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-thrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.6"},{"fixed":"1.7.6-tuxcare.1"}]}],"versions":["1.7.6"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.6"},{"fixed":"1.7.6-tuxcare.1"}]}],"versions":["1.7.6"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-toplevel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.6"},{"fixed":"1.7.6-tuxcare.1"}]}],"versions":["1.7.6"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:trevni-avro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.6"},{"fixed":"1.7.6-tuxcare.1"}]}],"versions":["1.7.6"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:trevni-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.6"},{"fixed":"1.7.6-tuxcare.1"}]}],"versions":["1.7.6"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:trevni-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.6"},{"fixed":"1.7.6-tuxcare.1"}]}],"versions":["1.7.6"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:trevni-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.6"},{"fixed":"1.7.6-tuxcare.1"}]}],"versions":["1.7.6"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.7"},{"fixed":"1.7.7-tuxcare.1"}]}],"versions":["1.7.7"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-archetypes-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.7"},{"fixed":"1.7.7-tuxcare.1"}]}],"versions":["1.7.7"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-compiler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.7"},{"fixed":"1.7.7-tuxcare.1"}]}],"versions":["1.7.7"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-ipc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.7"},{"fixed":"1.7.7-tuxcare.1"}]}],"versions":["1.7.7"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-mapred","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.7"},{"fixed":"1.7.7-tuxcare.1"}]}],"versions":["1.7.7"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-maven-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.7"},{"fixed":"1.7.7-tuxcare.1"}]}],"versions":["1.7.7"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.7"},{"fixed":"1.7.7-tuxcare.1"}]}],"versions":["1.7.7"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.7"},{"fixed":"1.7.7-tuxcare.1"}]}],"versions":["1.7.7"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-service-archetype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.7"},{"fixed":"1.7.7-tuxcare.1"}]}],"versions":["1.7.7"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-thrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.7"},{"fixed":"1.7.7-tuxcare.1"}]}],"versions":["1.7.7"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.7"},{"fixed":"1.7.7-tuxcare.1"}]}],"versions":["1.7.7"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-toplevel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.7"},{"fixed":"1.7.7-tuxcare.1"}]}],"versions":["1.7.7"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:trevni-avro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.7"},{"fixed":"1.7.7-tuxcare.1"}]}],"versions":["1.7.7"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:trevni-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.7"},{"fixed":"1.7.7-tuxcare.1"}]}],"versions":["1.7.7"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:trevni-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.7"},{"fixed":"1.7.7-tuxcare.1"}]}],"versions":["1.7.7"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:trevni-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.7"},{"fixed":"1.7.7-tuxcare.1"}]}],"versions":["1.7.7"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.2"},{"fixed":"1.8.2-tuxcare.4"}]}],"versions":["1.8.2","1.8.2-tuxcare.1","1.8.2-tuxcare.2","1.8.2-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-archetypes-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.2"},{"fixed":"1.8.2-tuxcare.4"}]}],"versions":["1.8.2","1.8.2-tuxcare.1","1.8.2-tuxcare.2","1.8.2-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-compiler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.2"},{"fixed":"1.8.2-tuxcare.4"}]}],"versions":["1.8.2","1.8.2-tuxcare.1","1.8.2-tuxcare.2","1.8.2-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-guava-dependencies","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.2"},{"fixed":"1.8.2-tuxcare.4"}]}],"versions":["1.8.2","1.8.2-tuxcare.1","1.8.2-tuxcare.2","1.8.2-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-ipc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.2"},{"fixed":"1.8.2-tuxcare.4"}]}],"versions":["1.8.2","1.8.2-tuxcare.1","1.8.2-tuxcare.2","1.8.2-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-mapred","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.2"},{"fixed":"1.8.2-tuxcare.4"}]}],"versions":["1.8.2","1.8.2-tuxcare.1","1.8.2-tuxcare.2","1.8.2-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-maven-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.2"},{"fixed":"1.8.2-tuxcare.4"}]}],"versions":["1.8.2","1.8.2-tuxcare.1","1.8.2-tuxcare.2","1.8.2-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.2"},{"fixed":"1.8.2-tuxcare.4"}]}],"versions":["1.8.2","1.8.2-tuxcare.1","1.8.2-tuxcare.2","1.8.2-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.2"},{"fixed":"1.8.2-tuxcare.4"}]}],"versions":["1.8.2","1.8.2-tuxcare.1","1.8.2-tuxcare.2","1.8.2-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-service-archetype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.2"},{"fixed":"1.8.2-tuxcare.4"}]}],"versions":["1.8.2","1.8.2-tuxcare.1","1.8.2-tuxcare.2","1.8.2-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-thrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.2"},{"fixed":"1.8.2-tuxcare.4"}]}],"versions":["1.8.2","1.8.2-tuxcare.1","1.8.2-tuxcare.2","1.8.2-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.2"},{"fixed":"1.8.2-tuxcare.4"}]}],"versions":["1.8.2","1.8.2-tuxcare.1","1.8.2-tuxcare.2","1.8.2-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-toplevel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.2"},{"fixed":"1.8.2-tuxcare.4"}]}],"versions":["1.8.2","1.8.2-tuxcare.1","1.8.2-tuxcare.2","1.8.2-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:trevni-avro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.2"},{"fixed":"1.8.2-tuxcare.4"}]}],"versions":["1.8.2","1.8.2-tuxcare.1","1.8.2-tuxcare.2","1.8.2-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:trevni-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.2"},{"fixed":"1.8.2-tuxcare.4"}]}],"versions":["1.8.2","1.8.2-tuxcare.1","1.8.2-tuxcare.2","1.8.2-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:trevni-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.2"},{"fixed":"1.8.2-tuxcare.4"}]}],"versions":["1.8.2","1.8.2-tuxcare.1","1.8.2-tuxcare.2","1.8.2-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:trevni-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.2"},{"fixed":"1.8.2-tuxcare.4"}]}],"versions":["1.8.2","1.8.2-tuxcare.1","1.8.2-tuxcare.2","1.8.2-tuxcare.3"]},{"source":"osv","ecosystem":"NuGet","package":"Apache.Avro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0"}]}],"versions":["1.10.0","1.10.0-alpha001","1.10.1","1.10.2","1.7.7","1.7.7.1","1.7.7.2","1.9.0","1.9.0-beta001","1.9.0-beta002","1.9.0-rc1","1.9.0-rc4","1.9.1","1.9.1-alpha001","1.9.1-alpha002","1.9.1-alpha003","1.9.1-rc1","1.9.2"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"avro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.2-4.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"avro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.2-4.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"avro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.2-4.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"avro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.2-4.oe2203sp2"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"avro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.2-4.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"avro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.2-4.oe2203sp2"}]}]}],"products":[{"vendor":"apache","product":"avro"},{"vendor":"apache software foundation","product":"apache avro"}],"references":[{"url":"https://lists.apache.org/thread/5fttw9vk6gd2p3b846nox7hcj5469xfd","tags":["x_refsource_MISC","x_transferred","Mailing List","Vendor Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2022/01/06/8","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-43045","tags":["advisory"]},{"url":"https://github.com/apache/avro/pull/1357","tags":["web"]},{"url":"https://issues.apache.org/jira/browse/AVRO-3225","tags":["web"]},{"url":"https://issues.apache.org/jira/browse/AVRO-3226","tags":["web"]},{"url":"https://github.com/advisories/GHSA-868x-rg4c-cjqg"},{"url":"https://github.com/apache/avro","tags":["package"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1950","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-43045","title":"Possible DOS vulnerabilities in C# Avro SDK","description":"A vulnerability in the .NET SDK of Apache Avro allows an attacker to allocate excessive resources, potentially causing a denial-of-service attack. This issue affects .NET applications using Apache Avro version 1.10.2 and prior versions. Users should update to version 1.11.0 which addresses this issue.","status":"published","published":"2022-01-06T18:00:12Z","modified":"2024-08-04T03:47:13.525Z","cwes":["CWE-770"],"updated_at":"2026-11-02T14:32:56.689433Z"}],"euvd":[{"id":"EUVD-2022-0519","description":"A vulnerability in the .NET SDK of Apache Avro allows an attacker to allocate excessive resources, potentially causing a denial-of-service attack. This issue affects .NET applications using Apache Avro version 1.10.2 and prior versions. Users should update to version 1.11.0 which addresses this issue.","status":"published","published":"2022-01-06T18:00:12Z","modified":"2024-08-04T03:47:13Z","updated_at":"2026-11-03T03:24:14.796505Z"}],"ghsa":[{"id":"GHSA-868x-rg4c-cjqg","title":"Allocation of Resources Without Limits or Throttling in Apache Avro","description":"A vulnerability in the .NET SDK of Apache Avro allows an attacker to allocate excessive resources, potentially causing a denial-of-service attack. This issue affects .NET applications using Apache Avro version 1.10.2 and prior versions. Users should update to version 1.11.0 which addresses this issue.","status":"published","published":"2022-01-08T00:39:20Z","modified":"2023-09-26T20:26:04Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:37:06.913882Z"}],"nvd":[{"id":"CVE-2021-43045","description":"A vulnerability in the .NET SDK of Apache Avro allows an attacker to allocate excessive resources, potentially causing a denial-of-service attack. This issue affects .NET applications using Apache Avro version 1.10.2 and prior versions. Users should update to version 1.11.0 which addresses this issue.","status":"published","published":"2022-01-06T18:15:07.863Z","modified":"2026-06-17T04:10:25.71Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:07:03.418194Z"}],"osv":[{"id":"CVE-2021-43045","description":"A vulnerability in the .NET SDK of Apache Avro allows an attacker to allocate excessive resources, potentially causing a denial-of-service attack. This issue affects .NET applications using Apache Avro version 1.10.2 and prior versions. Users should update to version 1.11.0 which addresses this issue.","status":"published","published":"2022-01-06T18:15:07.863Z","modified":"2026-10-24T10:30:18.601653135Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:21.557945Z"},{"id":"GHSA-868x-rg4c-cjqg","title":"Allocation of Resources Without Limits or Throttling in Apache Avro","description":"A vulnerability in the .NET SDK of Apache Avro allows an attacker to allocate excessive resources, potentially causing a denial-of-service attack. This issue affects .NET applications using Apache Avro version 1.10.2 and prior versions. Users should update to version 1.11.0 which addresses this issue.","status":"published","published":"2022-01-08T00:39:20Z","modified":"2024-02-16T08:12:26.47171Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:42.077781Z"},{"id":"OESA-2023-1950","title":"avro security update","description":"Apache Avro is a data serialization system.\r\n\r\nSecurity Fix(es):\r\n\r\nA vulnerability in the .NET SDK of Apache Avro allows an attacker to allocate excessive resources, potentially causing a denial-of-service attack. This issue affects .NET applications using Apache Avro version 1.10.2 and prior versions. Users should update to version 1.11.0 which addresses this issue.(CVE-2021-43045)","status":"published","published":"2023-12-22T11:06:24Z","modified":"2026-08-18T01:18:05.719249721Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"CLSA-2025-1765325273","title":"TuxCare security update for org.apache.avro (2 CVEs)","description":"TuxCare rebuilt 23 org.apache.avro packages to address 2 CVEs. Fixed in 1.10.2-tuxcare.2.","status":"published","published":"2026-08-04T14:52:06Z","modified":"2026-10-15T09:46:15.914212409Z","updated_at":"2026-11-02T15:43:42.847264Z"},{"id":"CLSA-2026-1778633128","title":"TuxCare security update for org.apache.avro (3 CVEs)","description":"TuxCare rebuilt 16 org.apache.avro packages to address 3 CVEs. Fixed in 1.7.6-tuxcare.1.","status":"published","published":"2026-08-04T14:52:31Z","modified":"2026-10-15T09:46:30.858371328Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1778633130","title":"TuxCare security update for org.apache.avro (3 CVEs)","description":"TuxCare rebuilt 16 org.apache.avro packages to address 3 CVEs. Fixed in 1.7.7-tuxcare.1.","status":"published","published":"2026-08-04T14:52:31Z","modified":"2026-10-15T09:46:30.8024139Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1786345204","title":"TuxCare security update for org.apache.avro (1 CVE)","description":"TuxCare rebuilt 17 org.apache.avro packages to address 1 CVE. Fixed in 1.8.2-tuxcare.4.","status":"published","published":"2026-08-10T07:00:04Z","modified":"2026-10-15T09:47:25.095679986Z","updated_at":"2026-11-02T15:43:46.850893Z"}]}}