CVE-2025-33042

Опубликовано: 13 фев. 2026

Источник: nvd

CVSS3: 7.3

EPSS Низкий

Описание

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas.

This issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0.

Users are recommended to upgrade to version 1.12.1 or 1.11.5, which fix the issue.

Ссылки

https://lists.apache.org/thread/fy88wmgf1lj9479vrpt12cv8x73lroj1
Issue Tracking
Mailing List
Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/02/12/2
Mailing List
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:apache:avro:*:*:*:*:*:-:*:*

Версия до 1.11.5 (исключая)

cpe:2.3:a:apache:avro:1.12.0:-:*:*:*:-:*:*

cpe:2.3:a:apache:avro:1.12.0:rc0:*:*:*:-:*:*

cpe:2.3:a:apache:avro:1.12.0:rc1:*:*:*:-:*:*

EPSS

Процентиль: 46%

0.00602

Низкий

7.3 High

CVSS3

Дефекты

CWE-94

Связанные уязвимости

CVE-2025-33042

CVSS3: 5.6

redhat

6 месяцев назад

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas. This issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0. Users are recommended to upgrade to version 1.12.1 or 1.11.5, which fix the issue.

GHSA-rp46-r563-jrc7

github