CLEANSTART-2026-QP89146 Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas

🗓️ 10 Sep 2026 03:06:13Reported by GoogleType

osv🔗 osv.dev👁 12 Views

Code injection in Apache Avro Java SDK via generating records from untrusted Avro schemas.

Reporter	Title	Published	Views	Family All 1000
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions	20 Aug 202615:19	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operational Decision Manager for December 2025 - Multiple CVEs addressed	29 Jan 202607:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in jackson-databind-2.16.0.jar	15 Sep 202620:48	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in jackson-databind [CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515]	24 Aug 202622:10	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Rational Developer for i	15 Sep 202613:43	–	ibm
IBM Security Bulletins	Security Bulletin:Vulnerability in Netty affects IBM Netezza Appliance	17 Dec 202513:22	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining 2.2.0	28 Sep 202613:49	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Content Cortex(CCx) 26.0.0-IF002 for August 2026	17 Sep 202614:30	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities found in Watson Data Intelligence	24 Aug 202605:21	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in netty-codec-http2-4.1.118.Final.jar	4 Feb 202618:39	–	ibm

Source	Link
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-QP89146.json
osv	www.osv.dev/vulnerability/CVE-2025-33042
osv	www.osv.dev/vulnerability/CVE-2025-41242
osv	www.osv.dev/vulnerability/CVE-2025-55163
osv	www.osv.dev/vulnerability/CVE-2025-59250
osv	www.osv.dev/vulnerability/CVE-2025-62728
osv	www.osv.dev/vulnerability/CVE-2026-12185
osv	www.osv.dev/vulnerability/CVE-2026-22745
osv	www.osv.dev/vulnerability/CVE-2026-40563
osv	www.osv.dev/vulnerability/CVE-2026-41603

18 Sep 2026 12:17Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.19.8

EPSS0.02127

Apache Avro Code Injection Untrusted Schemas Record Generation Apache Hive