RHLW-2026-6DD67008E326A981 Lightwell Security Advisory: avro 1.9.2.rhlw-00002

Red Hat Lightwell has released org.apache.avro:avro 1.9.2.rhlw-00002 with backported fixes for CVE-2024-47561 and CVE-2025-33042. CVE-2024-47561: Apache Avro Java SDK: Arbitrary Code Execution when reading Avro schema Java SDK CVE-2025-33042: Apache Avro Java SDK: Code injection on Java generated...

RHLW-2026-41BD2185E6D22E15 Lightwell Security Advisory: avro 1.11.0.rhlw-00002

Red Hat Lightwell has released org.apache.avro:avro 1.11.0.rhlw-00002 with backported fixes for CVE-2023-39410 and CVE-2024-47561. CVE-2023-39410: Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK CVE-2024-47561: Apache Avro Java SDK: Arbitrary Code Execution when...

CLEANSTART-2026-QP89146 Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas

Multiple security vulnerabilities affect the apache-hive package. Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas. See references for individual vulnerability details...

JLSEC-2026-1374 Apache Avro Java SDK: Arbitrary Code Execution when reading Avro Data (Java SDK)

Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code. Users are recommended to upgrade to version 1.11.4 or 1.12.0, which fix this issue...

PT-2026-85153

Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas. This issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0. Users are recommended to upgrade to version 1.12.1 o...

PT-2026-85152

Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code. Users are recommended to upgrade to version 1.11.4 or 1.12.0, which fix this issue...

CLSA-2026-1786540745 TuxCare security update for org.apache.avro (1 CVE)

TuxCare rebuilt 24 org.apache.avro packages to address 1 CVE. Fixed in 1.11.0-tuxcare.3...

CLSA-2026-1786540569 TuxCare security update for org.apache.avro (1 CVE)

TuxCare rebuilt 24 org.apache.avro packages to address 1 CVE. Fixed in 1.11.3-tuxcare.5...

CLSA-2026-1786345204 TuxCare security update for org.apache.avro (1 CVE)

TuxCare rebuilt 17 org.apache.avro packages to address 1 CVE. Fixed in 1.8.2-tuxcare.4...

CLSA-2026-1780966325 TuxCare security update for org.apache.avro (1 CVE)

TuxCare rebuilt 24 org.apache.avro packages to address 1 CVE. Fixed in 1.11.0-tuxcare.2...

CLSA-2026-1778633130 TuxCare security update for org.apache.avro (3 CVEs)

TuxCare rebuilt 16 org.apache.avro packages to address 3 CVEs. Fixed in 1.7.7-tuxcare.1...

CLSA-2026-1778719546 TuxCare security update for org.apache.avro (2 CVEs)

TuxCare rebuilt 17 org.apache.avro packages to address 2 CVEs. Fixed in 1.8.2-tuxcare.1...

CLSA-2026-1778633128 TuxCare security update for org.apache.avro (3 CVEs)

TuxCare rebuilt 16 org.apache.avro packages to address 3 CVEs. Fixed in 1.7.6-tuxcare.1...

CLSA-2025-1765238872 TuxCare security update for org.apache.avro (1 CVE)

TuxCare rebuilt 23 org.apache.avro packages to address 1 CVE. Fixed in 1.10.2-tuxcare.1...

Vulnerabilities found in Oracle Financial Services

Oracle has identified vulnerabilities in various Financial Services modules. Oracle has also processed updates for various third-party products. The vulnerabilities include code injection through malicious schemes in Apache Avro, unauthorized access to sensitive data in various Oracle products, a...

ROOT-APP-MAVEN-CVE-2023-39410 CVE-2023-39410 in io.root.org.apache.avro:avro - Patched by Root

Root has patched CVE-2023-39410 in the io.root.org.apache.avro:avro package for Root:Maven. Multiple fixed versions available...

Oracle GoldenGate for Big Data 19.1.x < 19.1.0.0.23 (April 2026 CPU)

According to its self-reported version number, the Oracle GoldenGate for Big Data application located on the remote host is affected by a vulnerability: - Vulnerability in the Oracle GoldenGate Big Data and Application Adapters product of Oracle GoldenGate component: Third Party Apache Avro...

Oracle GoldenGate for Big Data Multiple Vulnerabilities 21.x < 21.22.0.0.0 (April 2026 CPU)

According to its self-reported version number, the Oracle GoldenGate for Big Data application located on the remote host is affected by multiple vulnerabilities: - Vulnerability in the Oracle GoldenGate Big Data and Application Adapters product of Oracle GoldenGate component: Java Delivery Netty...

Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities

Summary IBM Enterprise Build of Quarkus is affected by vulnerabilities in Apache Avro, Jackson, Vert.x, plexus-utils and Netty Vulnerability Details CVEID:CVE-2025-67030 DESCRIPTION: Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils...

org.apache.avro/avro: Apache Avro Java SDK: Code injection on Java generated code

A code injection flaw has been discovered in Apache Avro. This vulnerability manifests when generating specific records from untrusted Avro schemas...