CVE-2025-33042: Apache Avro Code Injection Vulnerability in Java SDK
Summary
CVE-2025-33042: Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas. Affects avro versions < 1.11.5. Fixed in 1.11.5. How to fix ↓
Also tracked for
- org.apache.avro:avro · Maven
The same CVE-2025-33042 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Avro is a framework for data serialization that provides a compact, fast, binary data format. It is widely used for data exchange between systems in big data applications. The Avro Java SDK allows developers to work with Avro data in Java applications. However, certain versions of this SDK are vulnerable to code injection attacks when processing untrusted Avro schemas.
Vulnerability Detail
The vulnerability, identified as CVE-2025-33042, arises from improper control over the generation of code in the Apache Avro Java SDK. This flaw allows attackers to inject malicious code through untrusted Avro schemas, potentially leading to unauthorized access or execution of arbitrary code. The affected versions include all releases up to 1.11.4 and version 1.12.0. The implications of this vulnerability can be severe, as it may compromise the integrity and security of applications relying on the affected SDK.
How To Fix
Minimum fixed version
1.11.5
This is the first release that contains the fix.
pip install --upgrade "avro==1.11.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should avoid using untrusted Avro schemas until they can upgrade to a secure version of the SDK. Additionally, implementing strict validation of schemas before processing can help mitigate the risk.
Conclusion
The Apache Avro Java SDK has a critical vulnerability that allows for code injection through untrusted schemas. Users are strongly advised to upgrade to the patched versions to ensure the security of their applications. Implementing workarounds can help mitigate risks until an upgrade is possible.
See every vulnerability recorded for avro →
FAQ
The CVSS score for this vulnerability is 7.3, indicating a high severity level.
All versions of Apache Avro Java SDK through 1.11.4 and version 1.12.0 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If an immediate upgrade is not possible, avoid using untrusted Avro schemas and validate all schemas before processing.
Detailed information about this vulnerability can be found in the official Apache Avro security advisories and on vulnerability databases like CVE.
References
Related vulnerabilities
Recent vulnerabilities recorded for avro.
