Code Injection

🗓️ 18 Feb 2026 09:05:04Reported by Veracode Vulnerability DatabaseType

Code injection in Apache Avro avro-compiler allows code execution from attacker-controlled untrusted schemas during record generation.

Reporter	Title	Published	Views	Family All 50
IBM Security Bulletins	Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities	15 Apr 202615:10	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM StreamSets Data Collector	9 Mar 202621:02	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Terracotta is affected by an Apache Avro vulnerability that could allow code injection leading to access to unauthorized resources	6 Mar 202619:38	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Apache Avro Java SDK affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	4 May 202614:25	–	ibm
ATTACKERKB	CVE-2025-33042	13 Feb 202611:47	–	attackerkb
Chainguard	CVE-2025-33042 vulnerabilities	19 Feb 202607:17	–	cgr
Circl	CVE-2025-33042	12 Feb 202617:51	–	circl
CNNVD	Apache Avro Java SDK 安全漏洞	13 Feb 202600:00	–	cnnvd
CVE	CVE-2025-33042	13 Feb 202611:47	–	cve
Cvelist	CVE-2025-33042 Apache Avro Java SDK: Code injection on Java generated code	13 Feb 202611:47	–	cvelist

Vulners

Node

apache avro-compilerRange1.5.0–1.11.4java

Source	Link
github	www.github.com/apache/avro/pull/3150
issues	www.issues.apache.org/jira/browse/AVRO-4053
lists	www.lists.apache.org/thread/fy88wmgf1lj9479vrpt12cv8x73lroj1
github	www.github.com/apache/avro/commit/84bc7322ca1c04ab4a8e4e708acf1e271541aac4
openwall	www.openwall.com/lists/oss-security/2026/02/12/2

09 May 2026 05:11Current

5.4Medium risk

Vulners AI Score5.4

CVSS 3.17.3

EPSS0.00057

SSVC