CVE-2025-33042: Apache Avro Java SDK Code Injection Vulnerability
Summary
CVE-2025-33042: Apache Avro Java SDK is Vulnerable to Code Injection. Affects org.apache.avro:avro across 2 version ranges.
< 1.11.5
>= 1.12.0, < 1.12.1
Fixed in 1.11.5 or 1.12.1, depending on the release line you run. How to fix ↓
Also tracked for
- avro · PyPI
The same CVE-2025-33042 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Avro is a framework for data serialization, primarily used in big data applications. It provides a compact, fast, binary data format and is designed to work with various programming languages. The Java SDK of Apache Avro allows developers to work with Avro data in Java applications. However, it has been found to be vulnerable to code injection when generating records from untrusted Avro schemas, which can lead to severe security risks.
Vulnerability Detail
The vulnerability in Apache Avro Java SDK arises from improper control of code generation when handling untrusted Avro schemas. This can allow an attacker to inject malicious code, potentially leading to unauthorized access or manipulation of data. The issue affects all versions up to 1.11.4 and version 1.12.0, making it critical for users to address this vulnerability promptly.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.11.51.11.5 -
>= 1.12.0, < 1.12.11.12.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, users should avoid using untrusted Avro schemas for generating records until they can upgrade to the fixed versions. Implementing strict validation on schemas before processing can also help mitigate the risk.
Conclusion
The Apache Avro Java SDK vulnerability (CVE-2025-33042) poses a significant risk due to code injection possibilities from untrusted schemas. Users are strongly advised to upgrade to the latest patched versions to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for org.apache.avro:avro →
FAQ
The CVSS score of this vulnerability is 6.9, indicating a moderate severity level.
All versions through 1.11.4 and version 1.12.0 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By checking your pom.xml file on the Vulert playground, you can determine if your application is affected by this vulnerability.
If immediate upgrading is not possible, avoid using untrusted Avro schemas and implement strict validation on schemas to reduce risk.
More information can be found in the advisory published on GitHub and the official Apache Avro documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.avro:avro.
