CLEANSTART-2026-QP89146 Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas

Multiple security vulnerabilities affect the apache-hive package. Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas. See references for individual vulnerability details...

JLSEC-2026-1374 Apache Avro Java SDK: Arbitrary Code Execution when reading Avro Data (Java SDK)

Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code. Users are recommended to upgrade to version 1.11.4 or 1.12.0, which fix this issue...

PT-2026-85152

Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code. Users are recommended to upgrade to version 1.11.4 or 1.12.0, which fix this issue...

CLSA-2026-1786540745 TuxCare security update for org.apache.avro (1 CVE)

TuxCare rebuilt 24 org.apache.avro packages to address 1 CVE. Fixed in 1.11.0-tuxcare.3...

CLSA-2026-1786540569 TuxCare security update for org.apache.avro (1 CVE)

TuxCare rebuilt 24 org.apache.avro packages to address 1 CVE. Fixed in 1.11.3-tuxcare.5...

CLSA-2026-1786345204 TuxCare security update for org.apache.avro (1 CVE)

TuxCare rebuilt 17 org.apache.avro packages to address 1 CVE. Fixed in 1.8.2-tuxcare.4...

CLSA-2026-1780966325 TuxCare security update for org.apache.avro (1 CVE)

TuxCare rebuilt 24 org.apache.avro packages to address 1 CVE. Fixed in 1.11.0-tuxcare.2...

CLSA-2026-1778633128 TuxCare security update for org.apache.avro (3 CVEs)

TuxCare rebuilt 16 org.apache.avro packages to address 3 CVEs. Fixed in 1.7.6-tuxcare.1...

CLSA-2026-1778719546 TuxCare security update for org.apache.avro (2 CVEs)

TuxCare rebuilt 17 org.apache.avro packages to address 2 CVEs. Fixed in 1.8.2-tuxcare.1...

CLSA-2026-1778633130 TuxCare security update for org.apache.avro (3 CVEs)

TuxCare rebuilt 16 org.apache.avro packages to address 3 CVEs. Fixed in 1.7.7-tuxcare.1...

CLSA-2025-1765238872 TuxCare security update for org.apache.avro (1 CVE)

TuxCare rebuilt 23 org.apache.avro packages to address 1 CVE. Fixed in 1.10.2-tuxcare.1...

Vulnerabilities found in Oracle Financial Services

Oracle has identified vulnerabilities in various Financial Services modules. Oracle has also processed updates for various third-party products. The vulnerabilities include code injection through malicious schemes in Apache Avro, unauthorized access to sensitive data in various Oracle products, a...

ROOT-APP-MAVEN-CVE-2023-39410 CVE-2023-39410 in io.root.org.apache.avro:avro - Patched by Root

Root has patched CVE-2023-39410 in the io.root.org.apache.avro:avro package for Root:Maven. Multiple fixed versions available...

Oracle GoldenGate for Big Data Multiple Vulnerabilities 21.x < 21.22.0.0.0 (April 2026 CPU)

According to its self-reported version number, the Oracle GoldenGate for Big Data application located on the remote host is affected by multiple vulnerabilities: - Vulnerability in the Oracle GoldenGate Big Data and Application Adapters product of Oracle GoldenGate component: Java Delivery Netty...

Oracle GoldenGate for Big Data 19.1.x < 19.1.0.0.23 (April 2026 CPU)

According to its self-reported version number, the Oracle GoldenGate for Big Data application located on the remote host is affected by a vulnerability: - Vulnerability in the Oracle GoldenGate Big Data and Application Adapters product of Oracle GoldenGate component: Third Party Apache Avro...

Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities

Summary IBM Enterprise Build of Quarkus is affected by vulnerabilities in Apache Avro, Jackson, Vert.x, plexus-utils and Netty Vulnerability Details CVEID:CVE-2025-67030 DESCRIPTION: Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils...

org.apache.avro/avro: Apache Avro Java SDK: Code injection on Java generated code

A code injection flaw has been discovered in Apache Avro. This vulnerability manifests when generating specific records from untrusted Avro schemas...

org.apache.avro/avro: Apache Avro Java SDK: Code injection on Java generated code

A code injection flaw has been discovered in Apache Avro. This vulnerability manifests when generating specific records from untrusted Avro schemas...

Security Bulletin: IBM Terracotta is affected by an Apache Avro vulnerability that could allow code injection leading to access to unauthorized resources

Summary IBM Terracotta uses Apache Avro as part of Apache Parquet used within the IBM Terracotta implementation for data export and import. Vulnerability Details CVEID:CVE-2025-33042 DESCRIPTION: Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Avro Java SDK when...

Code Injection

org.apache.avro, avro-compiler is vulnerable to Code Injection. The vulnerability is due to improper validation of untrusted Avro schemas during specific record generation, where attacker-controlled schema content can be incorporated into generated Java source code without sufficient sanitization...