Apache Avro Java SDK: Arbitrary Code Execution when reading Avro Data (Java SDK)

ALTO 7.3CVE-2024-47561 · GHSA-r7pg-v2c8-mfg3 · Published 03/10/2024 · updated 17/06/2026

Em resumo

CVE-2024-47561 é uma vulnerabilidade ALTO (CVSS 7.3) que afeta org.apache.avro:avro, avro (apache).
Chance de exploração nos próximos 30 dias (EPSS): 3.3%, maior que 88.4% das vulnerabilidades.
Correção: atualize para 1.11.4 ou posterior.

Package	Affected versions	Patched versions
org.apache.avro:avro Maven	`< 1.11.4`	`1.11.4`
avro apache	`< 1.11.4`	`1.11.4`

Description

Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code. Users are recommended to upgrade to version 1.11.4 or 1.12.0, which fix this issue.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2024-47561 · ADVISORY
apache/avro#2934 · WEB
apache/avro#2980 · WEB
apache/avro commit 8f89868 · WEB
apache/avro commit f6b3bd7 · WEB
apache/avro · PACKAGE
issues.apache.org/jira/browse/AVRO-3985 · WEB
lists.apache.org/thread/c2v7mhqnmq0jmbwxqq3r5jbj1xg43h5x · WEB
security.netapp.com/advisory/ntap-20241011-0003 · WEB
thehackernews.com/2024/10/critical-apache-avro-sdk-flaw-allows.html · WEB
openwall.com/lists/oss-security/2024/10/03/1 · WEB
openwall.com/lists/oss-security/2024/10/03/1

Mais vulnerabilidades de org.apache.avro:avro

Ver tudo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.apache.avro:avro

Maven

< 1.11.4

1.11.4

avro

apache

< 1.11.4

1.11.4

Description

NVD description