RHLW-2026-9FA472B9239A3A7E Lightwell Security Advisory: avro-compiler 1.9.2.rhlw-00002

Red Hat Lightwell has released org.apache.avro:avro-compiler 1.9.2.rhlw-00002 with a backported security fix. CVE-2025-33042: Apache Avro Java SDK: Code injection on Java generated code This patched artifact is a drop-in replacement for org.apache.avro:avro-compiler 1.9.2 from Maven Central...

ae.teletronics.nlp:entityextraction (1.3), ae.teletronics.nlp:w2vec (1.0) +12663 more potentially affected by CVE-2025-33042 via org.apache.avro:avro (>=1.4.0, <=1.11.4)

org.apache.avro:avro MAVEN version =1.4.0, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.10 and more Source cves: CVE-2025-33042 Source advisory: MEND:CVE-2025-33042...

ai.telemetria:optima-spark4-databricks_2.13 (>=0.1.0, <=0.1.2), au.csiro.pathling:encoders (>=7.2.0, <=10.0.0) +1248 more potentially affected by CVE-2025-33042 via org.apache.avro:avro (1.12.0)

org.apache.avro:avro MAVEN version 1.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.avro:avro and may be impacted: - ai.telemetria:optima-spark4-databricks2.13 =0.1.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =10.0.0 - bio.ferlab:fhavro...

RCE (Remote Code Execution) org.apache.avro:avro Dependency in Bitbucket Data Center and Server

This High severity org.apache.avro:avro Dependency vulnerability was introduced in versions 8.6.0, 8.7.0, 8.8.0, 8.9.0, 8.10.0, 8.11.0, 8.12.0, 8.13.0, 8.14.0, 8.15.0, 8.16.0, 8.17.0, 8.18.0, 8.19.0, 9.0.0, 9.1.0, and 9.2.0 of Bitbucket Data Center and Server. This org.apache.avro:avro Dependency...

RCE (Remote Code Execution) org.apache.avro:avro Dependency in Bamboo Data Center and Server

This High severity org.apache.avro:avro Dependency vulnerability was introduced in versions 9.2.1, 9.6.0, and 10.0.0-rc3 of Bamboo Data Center and Server. This org.apache.avro:avro Dependency vulnerability, with a CVSS Score of 7.3 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L...

ae.teletronics.nlp:entityextraction (1.3), ae.teletronics.nlp:w2vec (1.0) +12325 more potentially affected by CVE-2024-47561 via org.apache.avro:avro (>=1.4.0, <=1.11.3)

org.apache.avro:avro MAVEN version =1.4.0, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.10 and more Source cves: CVE-2024-47561 Source advisory: GHSA-R7PG-V2C8-MFG3...

ae.teletronics.nlp:entityextraction (1.3), ae.teletronics.nlp:w2vec (1.0) +12325 more potentially affected by CVE-2024-47561 via org.apache.avro:avro (>=1.4.0, <=1.11.3)

org.apache.avro:avro MAVEN version =1.4.0, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.10 and more Source cves: CVE-2024-47561 Source advisory: OSV:GHSA-R7PG-V2C8-MFG3...

ae.teletronics.nlp:entityextraction (1.3), ae.teletronics.nlp:w2vec (1.0) +12325 more potentially affected by CVE-2024-47561 via org.apache.avro:avro (>=1.4.0, <=1.11.3)

org.apache.avro:avro MAVEN version =1.4.0, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.10 and more Source cves: CVE-2024-47561 Source advisory: MEND:CVE-2024-47561...

DoS (Denial of Service) org.apache.avro:avro Dependency in Jira Software Data Center and Server

This High severity org.apache.avro:avro Dependency vulnerability was introduced in versions 8.20.0, 9.0.0, 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, 9.6.0, 9.7.0, 9.8.0, 9.9.0, 9.10.0, 9.11.0, and 9.12.0 of Jira Software Data Center and Server. This org.apache.avro:avro Dependency vulnerability, with a...

DoS (Denial of Service) org.apache.avro:avro Dependency in Confluence Data Center and Server

This High severity org.apache.avro:avro Dependency vulnerability was introduced in versions 4.1 of Confluence Data Center and Server. This org.apache.avro:avro Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an...

DoS (Denial of Service) org.apache.avro:avro Dependency in Bamboo Data Center and Server

This High severity org.apache.avro:avro Dependency vulnerability was introduced in versions 9.2.1, 9.3.0, and 9.4.0 of Bamboo Data Center and Server. This org.apache.avro:avro Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allo...

ae.teletronics.nlp:entityextraction (1.3), ae.teletronics.nlp:w2vec (1.0) +11969 more potentially affected by CVE-2023-39410 via org.apache.avro:avro (>=1.4.0, <=1.11.2)

org.apache.avro:avro MAVEN version =1.4.0, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.10 and more Source cves: CVE-2023-39410 Source advisory: GHSA-RHRV-645H-FJFH...

ae.teletronics.nlp:entityextraction (1.3), ae.teletronics.nlp:w2vec (1.0) +11969 more potentially affected by CVE-2023-39410 via org.apache.avro:avro (>=1.4.0, <=1.11.2)

org.apache.avro:avro MAVEN version =1.4.0, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.10 and more Source cves: CVE-2023-39410 Source advisory: OSV:GHSA-RHRV-645H-FJFH...

ae.teletronics.nlp:entityextraction (1.3), ae.teletronics.nlp:w2vec (1.0) +11969 more potentially affected by CVE-2023-39410 via org.apache.avro:avro (>=1.4.0, <=1.11.2)

org.apache.avro:avro MAVEN version =1.4.0, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.10 and more Source cves: CVE-2023-39410 Source advisory: MEND:CVE-2023-39410...