Description
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas.
This issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0.
Users are recommended to upgrade to version 1.12.1 or 1.11.5, which fix the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Avro Java SDK | ≤ 1.11.4, 1.12.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | akhq | 0.26.0-r8 | — |
| Wolfi rolling | celeborn-0.6 | 0.6.2-r7 | — |
| Wolfi rolling | druid | 36.0.0-r1 | — |
| Wolfi rolling | logstash-9.3 +2 | 9.3.0-r0 | — |
| Wolfi rolling | spark-4.0-scala-2.13 | 4.0.2-r0 | — |
| Wolfi rolling | spark-4.1-scala-2.13 | 4.1.1-r4 | — |
| Wolfi rolling | wavefront-proxy | 13.9-r4 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.avro:avro-compiler | >= 1.12.0, < 1.12.1 | 1.12.1 | GHSA-rp46-r563-jrc7 |
| Maven | org.apache.avro:avro-compiler | < 1.11.5 | 1.11.5 | GHSA-rp46-r563-jrc7 |
| PyPI | avro | < 1.11.5 | 1.11.5 | PYSEC-2026-26 |
Advisories 4
- NCSC-2026-0258 Kwetsbaarheden verholpen in Oracle Financial Services NCSC-NL (Netherlands) · Jul 22, 2026
- WID-SEC-2026-2445 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 21, 2026
- WID-SEC-2026-1203 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 21, 2026
- WID-SEC-2026-1194 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 21, 2026
References
- https://lists.apache.org/thread/fy88wmgf1lj9479vrpt12cv8x73lroj1 vendor-advisory