CVE-2025-33042 Apache Avro Java SDK: Code injection on Java generated code

🗓️ 13 Feb 2026 11:47:03Reported by apacheType

Code injection in Apache Avro Java SDK during record generation from untrusted schemas; upgrade to 1.12.1 or 1.11.5.

Reporter	Title	Published	Views	Family All 49
IBM Security Bulletins	Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities	15 Apr 202615:10	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM StreamSets Data Collector	9 Mar 202621:02	–	ibm
IBM Security Bulletins	Security Bulletin: The following vulnerabilities that can affect IBM Storage Scale Management GUI, Cloudkit or HDFS layer are now fixed in 5.2.3.7 and 6.0.1.0 or higher	5 Jun 202619:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Terracotta is affected by an Apache Avro vulnerability that could allow code injection leading to access to unauthorized resources	6 Mar 202619:38	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Apache Avro Java SDK affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	4 May 202614:25	–	ibm
ATTACKERKB	CVE-2025-33042	13 Feb 202611:47	–	attackerkb
Chainguard	CVE-2025-33042 vulnerabilities	19 Feb 202607:17	–	cgr
Circl	CVE-2025-33042	12 Feb 202617:51	–	circl
CNNVD	Apache Avro Java SDK 安全漏洞	13 Feb 202600:00	–	cnnvd
CVE	CVE-2025-33042	13 Feb 202611:47	–	cve

[
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.avro:avro",
    "product": "Apache Avro Java SDK",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "1.11.4",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "1.12.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
lists	www.lists.apache.org/thread/fy88wmgf1lj9479vrpt12cv8x73lroj1

13 Feb 2026 11:47Current

EPSS0.00602

CWE-94