JLSEC-2026-1374 Critical 9.2

Apache Avro Java SDK: Arbitrary Code Execution when reading Avro Data (Java SDK)

JLSEC Published: Aug 24, 2026
Modified: Aug 24, 2026
Severity: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Affected Packages: Avro_jll *
Upstream: CVE-2024-47561 GHSA-r7pg-v2c8-mfg3 EUVD-2024-3126

Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code. Users are recommended to upgrade to version 1.11.4 or 1.12.0, which fix this issue.

References

http://www.openwall.com/lists/oss-security/2024/10/03/1
https://github.com/advisories/GHSA-r7pg-v2c8-mfg3
https://github.com/apache/avro/commit/8f89868d29272e3afea2ff8de8c85cb81a57d900
https://github.com/apache/avro/commit/f6b3bd7e50e6e09fedddb98c61558c022ba31285
https://github.com/apache/avro/pull/2934
https://github.com/apache/avro/pull/2980
https://issues.apache.org/jira/browse/AVRO-3985
https://lists.apache.org/thread/c2v7mhqnmq0jmbwxqq3r5jbj1xg43h5x
https://nvd.nist.gov/vuln/detail/CVE-2024-47561
https://security.netapp.com/advisory/ntap-20241011-0003
https://security.netapp.com/advisory/ntap-20241011-0003/
https://thehackernews.com/2024/10/critical-apache-avro-sdk-flaw-allows.html
https://www.openwall.com/lists/oss-security/2024/10/03/1