Apache Avro Java SDK: Arbitrary Code Execution when reading Avro schema (Java SDK)
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.2epss 3.3%
exploitation probability
3.3%top 12% of all CVEs
observed exploitation
nono source reports it
Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code.
Users are recommended to upgrade to version 1.11.4 or 1.12.0, which fix this issue.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Apache Software Foundation · Apache Avro Java SDK