Apache Avro Java Sdk (Apache Software Foundation) - vulnerabilities (CVEs)

3 CVEs, 0 in the last 30 days, 3 known versions, newest CVE from 2026-02-13. Vendor: Apache Software Foundation.

CVEs of Apache Avro Java Sdk

• CVE-2025-33042 - CVSS 7.3 (high), 2026-02-13: Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas.…
• CVE-2024-47561 - CVSS 9.2 (critical), 2024-10-03: Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code. Users are recommended to upgrade to…
• CVE-2023-39410 - CVSS 7.5 (high), 2023-09-29: When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on…