Search
Search is not available in local development.
Run npx pagefind --site __site after building to enable it.
JLSEC-2026-1375 Medium 6.9

Apache Avro Java SDK is Vulnerable to Code Injection

SourceEditHistoryOSVJSON (OSV)
JLSEC Published
Modified
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Affected Packages
Avro_jll *
Upstream
CVE-2025-33042 GHSA-rp46-r563-jrc7 EUVD-2025-206910 PYSEC-2026-26

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas.

This issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0.

Users are recommended to upgrade to version 1.12.1 or 1.11.5, which fix the issue.

References