CVE-2024-47561criticalCWE-502

CVE-2024-47561: critical vulnerability in Apache Avro Java SDK

Apache Avro Java SDK: Arbitrary Code Execution when reading Avro schema (Java SDK)

Published · Updated

Follow this CVE+ Monitor Apache Avro Java SDK+ Monitor org.apache.avro:avro

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.2epss 3.3%
Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code. Users are recommended to upgrade to version 1.11.4  or 1.12.0, which fix this issue.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Apache Software Foundation · Apache Avro Java SDK
Related CVEs — Apache Avro Java SDK

In the same product, most dangerous first.

CVE-2023-39410—Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDKEPSS 2.2%CVE-2025-33042HIGHApache Avro Java SDK: Code injection on Java generated codeEPSS 0.7%