Avro vulnerabilities

6 known vulnerabilities in Avro from Apache. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.3 High severity

  Apache Avro Java SDK: Improper Control of Generation of Code

  CVE-2025-33042Feb 13, 2026Apache

  Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas. This issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0. Users are rec

• 9.2 Critical severity

  Apache Avro Java SDK: Deserialization of Untrusted Data

  CVE-2024-47561Oct 3, 2024ApacheEPSS 3.26%

  Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code. Users are recommended to upgrade to version 1.11.4 or 1.12.0, which fix this issue.

• 7.5 High severity

  Apache Avro Java SDK: Deserialization of Untrusted Data

  CVE-2023-39410Sep 29, 2023ApacheEPSS 2.22%

  When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system. This issue affects Java applications using Apache Avro Java SDK up to and including 1.11.

• 7.5 High severity

  Apache Avro: Integer Overflow or Wraparound

  CVE-2022-36125Aug 9, 2022ApacheEPSS 1.59%

  It is possible to crash (panic) an application by providing a corrupted data to be read. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to apache-avro version 0.14.0 which addr

• 7.5 High severity

  Apache Avro: Allocation of Resources Without Limits or Throttling

  CVE-2022-36124Aug 9, 2022ApacheEPSS 1.55%

  It is possible for a Reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to apa

• 7.5 High severity

  Apache Avro: Loop with Unreachable Exit Condition

  CVE-2022-35724Aug 9, 2022ApacheEPSS 1.82%

  It is possible to provide data to be read that leads the reader to loop in cycles endlessly, consuming CPU. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to apache-avro versio