Apache Avro Java SDK: Arbitrary Code Execution when reading Avro Data (Java SDK)

ALTO 7.3CVE-2024-47561 · GHSA-r7pg-v2c8-mfg3 · Published 03/10/2024 · updated 17/06/2026

En resumen

CVE-2024-47561 es una vulnerabilidad ALTO (CVSS 7.3) que afecta a org.apache.avro:avro, avro (apache).
Probabilidad de explotación en los próximos 30 días (EPSS): 3.3%, mayor que el 88.4% de las vulnerabilidades.
Solución: actualizar a 1.11.4 o posterior.

Package	Affected versions	Patched versions
org.apache.avro:avro Maven	`< 1.11.4`	`1.11.4`
avro apache	`< 1.11.4`	`1.11.4`

Description

Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code. Users are recommended to upgrade to version 1.11.4 or 1.12.0, which fix this issue.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2024-47561 · ADVISORY
apache/avro#2934 · WEB
apache/avro#2980 · WEB
apache/avro commit 8f89868 · WEB
apache/avro commit f6b3bd7 · WEB
apache/avro · PACKAGE
issues.apache.org/jira/browse/AVRO-3985 · WEB
lists.apache.org/thread/c2v7mhqnmq0jmbwxqq3r5jbj1xg43h5x · WEB
security.netapp.com/advisory/ntap-20241011-0003 · WEB
thehackernews.com/2024/10/critical-apache-avro-sdk-flaw-allows.html · WEB
openwall.com/lists/oss-security/2024/10/03/1 · WEB
openwall.com/lists/oss-security/2024/10/03/1 · WEB
security.netapp.com/advisory/ntap-20241011-0003 · Third Party Advisory

Más vulnerabilidades de org.apache.avro:avro

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free