Description
Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code.
Users are recommended to upgrade to version 1.11.4 or 1.12.0, which fix this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Avro Java SDK | < 1.11.4 | 1.11.4 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-apache-cxf +3 | 3.1.16-3.SP1_redhat_00001.1.ep7.el7 | RHSA-2024:10208, RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-avro | 1.7.6-2.redhat_00003.1.ep7.el7 | RHSA-2024:10208, RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-bouncycastle +3 | 1.68.0-1.redhat_00005.1.ep7.el7 | RHSA-2024:10208 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-h2database | 1.4.197-2.redhat_00005.1.ep7.el7 | RHSA-2024:10208, RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jackson-databind | 2.8.11.6-1.SP1_redhat_00001.1.ep7.el7 | RHSA-2024:10208 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jboss-annotations-api_1.3_spec | 2.0.1-4.Final_redhat_00001.1.el7eap | RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jboss-marshalling +1 | 2.0.15-1.Final_redhat_00001.1.el7eap | RHSA-2024:10208, RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jboss-server-migration +21 | 1.7.2-12.Final_redhat_00013.1.el7eap | RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jboss-xnio-base | 3.5.10-1.Final_redhat_00001.1.ep7.el7 | RHSA-2024:10208, RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-log4j-jboss-logmanager | 1.2.2-2.Final_redhat_00002.1.el7eap | RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly +1 | 7.1.8-2.GA_redhat_00002.1.ep7.el7 | RHSA-2024:10208, RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly-javadocs +2 | 7.3.11-4.GA_redhat_00002.1.el7eap | RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wss4j +6 | 2.3.3-2.redhat_00001.1.el7eap | RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-xalan-j2 | 2.7.1-26.redhat_00015.1.ep7.el7 | RHSA-2024:10208, RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-xml-security | 2.2.3-2.redhat_00001.1.el7eap | RHSA-2024:10207 |
| Red Hat JBoss EAP 7 | eap7-avro | 1.11.4-1.redhat_00001.1.el7eap | RHSA-2024:7811 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | akhq | 0.25.1-r1 | — |
| Wolfi rolling | apache-nifi +2 | 2.3.0-r0 | — |
| Wolfi rolling | celeborn-0.6 | 0.6.3-r7 | — |
| Wolfi rolling | druid | 36.0.0-r0 | — |
| Wolfi rolling | logstash-8-with-output-opensearch | 8.17.3-r3 | — |
| Wolfi rolling | tez | 0.10.4-r8 | — |
| Wolfi rolling | trino +58 | 472-r0 | — |
| Wolfi rolling | wavefront-proxy +3 | 13.7-r2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.avro:avro | < 1.11.4 | 1.11.4 | GHSA-r7pg-v2c8-mfg3 |
Advisories 21
- WID-SEC-2025-0135 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 3, 2026
- WID-SEC-2024-3147 Red Hat Produkte: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 3, 2026
- RHSA-2024:7811 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4 Security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2024:10208 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.8 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2024:10207 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.11 Security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- NCSC-2026-0258 Kwetsbaarheden verholpen in Oracle Financial Services NCSC-NL (Netherlands) · Jul 22, 2026
- WID-SEC-2026-2445 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 21, 2026
- WID-SEC-2024-3180 Apache Camel und mehrere Red Hat Produkte: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 18, 2025
- WID-SEC-2025-0143 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 17, 2025
- WID-SEC-2025-1571 Oracle Hyperion: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 15, 2025
- WID-SEC-2025-0919 LogStash: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · May 1, 2025
- NCSC-2025-0128 Kwetsbaarheden verholpen in Oracle Fusion Middleware NCSC-NL (Netherlands) · Apr 16, 2025
- NCSC-2025-0123 Kwetsbaarheden verholpen in Oracle Database Producten NCSC-NL (Netherlands) · Apr 16, 2025
- WID-SEC-2025-0818 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 15, 2025
- WID-SEC-2025-0402 Atlassian Bitbucket: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Feb 18, 2025
- NCSC-2025-0028 Kwetsbaarheden verholpen in Oracle Analytics NCSC-NL (Netherlands) · Jan 22, 2025
- NCSC-2025-0027 Kwetsbaarheden verholpen in Oracle Fusion Middleware NCSC-NL (Netherlands) · Jan 22, 2025
- NCSC-2025-0021 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Jan 22, 2025
- NCSC-2025-0020 Kwetsbaarheden verholpen in Oracle Database producten NCSC-NL (Netherlands) · Jan 22, 2025
- NCSC-2024-0466 Kwetsbaarheden verholpen in Atlassian producten NCSC-NL (Netherlands) · Dec 6, 2024
- WID-SEC-2024-3111 Red Hat JBoss Enterprise Application Platform: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Nov 24, 2024
References
- https://lists.apache.org/thread/c2v7mhqnmq0jmbwxqq3r5jbj1xg43h5x vendor-advisory