CVE-2025-33042

High CVSS: 7.3

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas.

This issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0.

Users are recommended to upgrade to version 1.12.1 or 1.11.5, which fix the issue.

Vendor

Apache

Product

Avro

CWE

CWE-94

Yayın Tarihi

2026-02-13 12:16:07

Güncelleme

2026-02-20 15:07:04

Source Identifier

security@apache.org

KEV Date Added

Kategoriler

CWE-94 Avro HIGH Apache 2026

Referanslar

https://lists.apache.org/thread/fy88wmgf1lj9479vrpt12cv8x73lroj1 http://www.openwall.com/lists/oss-security/2026/02/12/2

Benzer Kayıtlar

High

CVE-2025-65114

Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Se…

High

CVE-2025-58136

A bug in POST request handling causes a crash under a certain condition. This issue affects Apache Traffic Server: from…

Medium

CVE-2026-32794

Improper Certificate Validation vulnerability in Apache Airflow Provider for Databricks. Provider code did not validate…

Low

CVE-2026-32642

Incorrect Authorization (CWE-863) vulnerability in Apache Artemis, Apache ActiveMQ Artemis exists when an application us…

Medium

CVE-2026-26929

Apache Airflow versions 3.0.0 through 3.1.7 FastAPI DagVersion listing API does not apply per-DAG authorization filterin…

Medium

CVE-2026-28563

Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG dependency graph without filt…