CVE-2025-33042

Published: Feb 13, 2026Modified: Jun 17, 2026

7.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Exploitability: 3.9 / Impact: 3.4

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas. This issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0. Users are recommended to upgrade to version 1.12.1 or 1.11.5, which fix the issue.

Affected (4)

Products: Apache: Avro

1 product

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Apache Avro	Before 1.11.5
Apache Avro	Version 1.12.0
Apache Avro	Version 1.12.0 rc0
Apache Avro	Version 1.12.0 rc1

Related CWEs

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (2)

https://lists.apache.org/thread/fy88wmgf1lj9479vrpt12cv8x73lroj1

Source: security@apache.org

Issue TrackingMailing ListVendor Advisory

http://www.openwall.com/lists/oss-security/2026/02/12/2

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

Timeline

No history available yet.