CVE-2023-39410CWE-502

CVE-2023-39410: vulnerability in Apache Avro Java SDK

Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK

Published · Updated

Follow this CVE+ Monitor Apache Avro Java SDK+ Monitor avro

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 2.2%
When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system. This issue affects Java applications using Apache Avro Java SDK up to and including 1.11.2. Users should update to apache-avro version 1.11.3 which addresses this issue.
Affected products
Apache Software Foundation · Apache Avro Java SDK
Related CVEs — Apache Avro Java SDK

In the same product, most dangerous first.

CVE-2024-47561CRITICALApache Avro Java SDK: Arbitrary Code Execution when reading Avro schema (Java SDK)EPSS 3.3%CVE-2025-33042HIGHApache Avro Java SDK: Code injection on Java generated codeEPSS 0.7%