{"id":"CVE-2025-33042","aliases":["CLSA-2026-1786540164","CLSA-2026-1786540569","CLSA-2026-1786540745","CLSA-2026-1792063230","CLSA-2026-1792063313","CLSA-2026-1792663402","CLSA-2026-1794253414","EUVD-2025-206910","GHSA-r7pg-v2c8-mfg3","GHSA-rp46-r563-jrc7","JLSEC-2026-1375","PYSEC-2026-26","RHLW-2026-6dd67008e326a981","RHLW-2026-9fa472b9239a3a7e"],"status":"published","title":"Apache Avro Java SDK: Code injection on Java generated code","description":"Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas.\n\nThis issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0.\n\nUsers are recommended to upgrade to version 1.12.1 or 1.11.5, which fix the issue.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00632,"percentile":0.50784,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-94"],"published":"2026-02-13T11:47:03Z","modified":"2026-11-10T01:15:03Z","fixes":[{"ecosystem":"Maven","package":"org.apache.avro:avro-compiler","fixed_in":["1.12.1","1.11.5"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-compiler","fixed_in":["1.10.2-tuxcare.4","1.11.3-tuxcare.5","1.11.0-tuxcare.3","1.7.7-tuxcare.5","1.7.6-tuxcare.5"],"sources":["osv"]},{"ecosystem":"PyPI","package":"avro","fixed_in":["1.11.5"],"sources":["osv"]},{"ecosystem":"Red Hat Lightwell:Maven","package":"org.apache.avro:avro-compiler","fixed_in":["1.9.2.rhlw-00002"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.avro:avro-compiler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"last_affected":"1.12.0"},{"fixed":"1.12.1"}]}],"versions":["1.12.0"]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.avro:avro-compiler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.5"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-compiler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.2"},{"fixed":"1.10.2-tuxcare.4"}]}],"versions":["1.10.2","1.10.2-tuxcare.1","1.10.2-tuxcare.2","1.10.2-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-compiler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.11.3"},{"fixed":"1.11.3-tuxcare.5"}]}],"versions":["1.11.3","1.11.3-tuxcare.1","1.11.3-tuxcare.2","1.11.3-tuxcare.3","1.11.3-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-compiler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.11.0"},{"fixed":"1.11.0-tuxcare.3"}]}],"versions":["1.11.0","1.11.0-tuxcare.1","1.11.0-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-compiler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.7"},{"fixed":"1.7.7-tuxcare.5"}]}],"versions":["1.7.7","1.7.7-tuxcare.1","1.7.7-tuxcare.2","1.7.7-tuxcare.3","1.7.7-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-compiler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.6"},{"fixed":"1.7.6-tuxcare.5"}]}],"versions":["1.7.6","1.7.6-tuxcare.1","1.7.6-tuxcare.2","1.7.6-tuxcare.3","1.7.6-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9.2"},{"fixed":"1.9.2-tuxcare.1"}]}],"versions":["1.9.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-compiler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9.2"},{"fixed":"1.9.2-tuxcare.1"}]}],"versions":["1.9.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.11.1"},{"fixed":"1.11.1-tuxcare.1"}]}],"versions":["1.11.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.avro:avro-compiler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.11.1"},{"fixed":"1.11.1-tuxcare.1"}]}],"versions":["1.11.1"],"bundled":3},{"source":"osv","ecosystem":"Maven","package":"org.apache.avro:avro-compiler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"1.12.1"}]}],"versions":["1.12.0"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.avro:avro-compiler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.5"}]}],"versions":["1.10.0","1.10.1","1.10.2","1.11.0","1.11.1","1.11.2","1.11.3","1.11.4","1.5.0","1.5.1","1.5.2","1.5.3","1.5.4","1.6.0","1.6.1","1.6.2","1.6.3","1.7.0","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.8.0","1.8.1","1.8.2","1.9.0","1.9.1","1.9.2"]},{"source":"osv","ecosystem":"Julia","package":"Avro_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"avro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.5"}]}],"versions":["1.10.0","1.10.1","1.10.2","1.11.0","1.11.1","1.11.2","1.11.3","1.3.3","1.4.1","1.5.0","1.5.1","1.5.2","1.5.3","1.5.4","1.6.0","1.6.1","1.6.2","1.6.3","1.7.0","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.8.0","1.8.1","1.8.2","1.9.0","1.9.1","1.9.2"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.apache.avro:avro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2.rhlw-00002"}]}],"versions":["1.4.0","1.4.1","1.5.0","1.5.1","1.5.2","1.5.3","1.5.4","1.6.0","1.6.1","1.6.2","1.6.3","1.7.0","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.8.0","1.8.1","1.8.2","1.9.0","1.9.1","1.9.2"],"bundled":2},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.apache.avro:avro-compiler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2.rhlw-00002"}]}],"versions":["1.5.0","1.5.1","1.5.2","1.5.3","1.5.4","1.6.0","1.6.1","1.6.2","1.6.3","1.7.0","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.8.0","1.8.1","1.8.2","1.9.0","1.9.1","1.9.2"]}],"products":[{"vendor":"apache","product":"avro"},{"vendor":"apache software foundation","product":"apache avro java sdk"}],"references":[{"url":"https://lists.apache.org/thread/fy88wmgf1lj9479vrpt12cv8x73lroj1","tags":["vendor-advisory","Issue Tracking","Mailing List","Vendor Advisory","advisory","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2026/02/12/2","tags":["Mailing List","Third Party Advisory","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-33042","tags":["advisory","web"]},{"url":"https://github.com/apache/avro/pull/3150","tags":["web"]},{"url":"https://github.com/apache/avro/commit/84bc7322ca1c04ab4a8e4e708acf1e271541aac4","tags":["web"]},{"url":"https://issues.apache.org/jira/browse/AVRO-4053","tags":["web"]},{"url":"https://security.snyk.io/vuln/SNYK-JAVA-ORGAPACHEAVRO-15282783","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/avro/PYSEC-2026-26.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rp46-r563-jrc7","tags":["web","advisory"]},{"url":"https://repo.maven.apache.org/maven2","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/33xxx/CVE-2025-33042.json","tags":["advisory"]},{"url":"https://github.com/apache/avro","tags":["package"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47561.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/c2v7mhqnmq0jmbwxqq3r5jbj1xg43h5x","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47561","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-r7pg-v2c8-mfg3","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-33042","title":"Apache Avro Java SDK: Code injection on Java generated code","description":"Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas.\n\nThis issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0.\n\nUsers are recommended to upgrade to version 1.12.1 or 1.11.5, which fix the issue.","status":"published","published":"2026-02-13T11:47:03.783Z","modified":"2026-02-13T18:05:35.038Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"adp"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:32:52.21763Z"}],"euvd":[{"id":"EUVD-2025-206910","description":"Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas.\n\nThis issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0.\n\nUsers are recommended to upgrade to version 1.12.1 or 1.11.5, which fix the issue.","status":"published","published":"2026-02-13T11:47:03Z","modified":"2026-02-13T18:05:35Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T19:48:39.919829Z"}],"ghsa":[{"id":"GHSA-rp46-r563-jrc7","title":"Apache Avro Java SDK is Vulnerable to Code Injection","description":"Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas.\n\nThis issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0.\n\nUsers are recommended to upgrade to version 1.12.1 or 1.11.5, which fix the issue.","status":"published","published":"2026-02-13T12:31:21Z","modified":"2026-06-05T14:25:54Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:40:16.698699Z"}],"nvd":[{"id":"CVE-2025-33042","description":"Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas.\n\nThis issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0.\n\nUsers are recommended to upgrade to version 1.12.1 or 1.11.5, which fix the issue.","status":"published","published":"2026-02-13T12:16:07.57Z","modified":"2026-06-17T09:13:00.17Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:12:00.273026Z"}],"osv":[{"id":"CVE-2025-33042","title":"Apache Avro Java SDK: Code injection on Java generated code","description":"Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas.\n\nThis issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0.\n\nUsers are recommended to upgrade to version 1.12.1 or 1.11.5, which fix the issue.","status":"published","published":"2026-02-13T11:47:03.783Z","modified":"2026-10-28T10:45:24.322495731Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:44:48.02508Z"},{"id":"GHSA-rp46-r563-jrc7","title":"Apache Avro Java SDK is Vulnerable to Code Injection","description":"Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas.\n\nThis issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0.\n\nUsers are recommended to upgrade to version 1.12.1 or 1.11.5, which fix the issue.","status":"published","published":"2026-02-13T12:31:21Z","modified":"2026-09-10T03:50:35.78697644Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:56.281047Z"},{"id":"JLSEC-2026-1375","title":"Apache Avro Java SDK is Vulnerable to Code Injection","description":"Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas.\n\nThis issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0.\n\nUsers are recommended to upgrade to version 1.12.1 or 1.11.5, which fix the issue.","status":"published","published":"2026-08-24T13:43:17.899Z","modified":"2026-08-24T14:14:20.444996644Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"PYSEC-2026-26","description":"Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas.\n\nThis issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0.\n\nUsers are recommended to upgrade to version 1.12.1 or 1.11.5, which fix the issue.","status":"published","published":"2026-02-13T12:16:07.57Z","modified":"2026-05-20T09:18:53.72349Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:55.961245Z"},{"id":"RHLW-2026-6dd67008e326a981","title":"Lightwell Security Advisory: avro 1.9.2.rhlw-00002","description":"Red Hat Lightwell has released org.apache.avro:avro 1.9.2.rhlw-00002 with backported fixes for CVE-2024-47561 and CVE-2025-33042.\n\nCVE-2024-47561: Apache Avro Java SDK: Arbitrary Code Execution when reading Avro schema (Java SDK)\n\nCVE-2025-33042: Apache Avro Java SDK: Code injection on Java generated code\n\nThis patched artifact is a drop-in replacement for org.apache.avro:avro 1.9.2 from Maven Central.","status":"published","published":"2026-09-23T15:43:01Z","modified":"2026-10-27T04:00:10.724612476Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-9fa472b9239a3a7e","title":"Lightwell Security Advisory: avro-compiler 1.9.2.rhlw-00002","description":"Red Hat Lightwell has released org.apache.avro:avro-compiler 1.9.2.rhlw-00002 with a backported security fix.\n\nCVE-2025-33042: Apache Avro Java SDK: Code injection on Java generated code\n\nThis patched artifact is a drop-in replacement for org.apache.avro:avro-compiler 1.9.2 from Maven Central.","status":"published","published":"2026-10-13T19:09:45Z","modified":"2026-10-27T04:00:12.341990803Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"CLSA-2026-1786540164","title":"TuxCare security update for org.apache.avro:avro-compiler (1 CVE)","description":"TuxCare rebuilt org.apache.avro:avro-compiler to address 1 CVE. Fixed in 1.10.2-tuxcare.4.","status":"published","published":"2026-08-12T13:09:24Z","modified":"2026-11-02T19:45:56.119847801Z","updated_at":"2026-11-02T20:30:00.884471Z"},{"id":"CLSA-2026-1786540569","title":"TuxCare security update for org.apache.avro:avro-compiler (1 CVE)","description":"TuxCare rebuilt org.apache.avro:avro-compiler to address 1 CVE. Fixed in 1.11.3-tuxcare.5.","status":"published","published":"2026-08-12T13:16:09Z","modified":"2026-11-02T19:45:55.752623431Z","updated_at":"2026-11-02T20:30:00.884471Z"},{"id":"CLSA-2026-1786540745","title":"TuxCare security update for org.apache.avro:avro-compiler (1 CVE)","description":"TuxCare rebuilt org.apache.avro:avro-compiler to address 1 CVE. Fixed in 1.11.0-tuxcare.3.","status":"published","published":"2026-08-12T13:19:05Z","modified":"2026-11-02T19:45:56.089634546Z","updated_at":"2026-11-02T20:30:00.884471Z"},{"id":"CLSA-2026-1792063230","title":"TuxCare security update for org.apache.avro:avro-compiler (1 CVE)","description":"TuxCare rebuilt org.apache.avro:avro-compiler to address 1 CVE. Fixed in 1.7.7-tuxcare.5.","status":"published","published":"2026-10-15T11:20:30Z","modified":"2026-11-02T19:46:28.516182766Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792063313","title":"TuxCare security update for org.apache.avro:avro-compiler (1 CVE)","description":"TuxCare rebuilt org.apache.avro:avro-compiler to address 1 CVE. Fixed in 1.7.6-tuxcare.5.","status":"published","published":"2026-10-15T11:21:53Z","modified":"2026-11-02T19:46:28.535907306Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792663402","title":"TuxCare security update for org.apache.avro (2 CVEs)","description":"TuxCare rebuilt 2 org.apache.avro packages to address 2 CVEs. Fixed in 1.9.2-tuxcare.1.","status":"published","published":"2026-10-22T10:03:22Z","modified":"2026-11-02T19:46:30.510832482Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1794253414","title":"TuxCare security update for org.apache.avro (3 CVEs)","description":"TuxCare rebuilt 2 org.apache.avro packages to address 3 CVEs. Fixed in 1.11.1-tuxcare.1.","status":"published","published":"2026-11-09T20:43:34Z","modified":"2026-11-10T01:15:03.453043748Z","updated_at":"2026-11-10T01:43:20.132342Z"}]}}