Open-source package vulnerability · Maven
CVE-2024-47561: Apache Avro Java SDK: Arbitrary Code Execution when reading Avro Data (Java SDK)
criticalCVSS 4.0 9.3 · 3.1 9.8GHSA-r7pg-v2c8-mfg3
Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code. Users are recommended to upgrade to version 1.11.4 or 1.12.0, which fix this issue.
Published Oct 3, 2024 · Updated Jul 10, 2025
Affected packages
org.apache.avro:avro
- Ecosystem
- Maven
- Affected
- < 1.11.4
- Fixed in
- 1.11.4
- Check
mvn dependency:tree -Dincludes=org.apache.avro:avro
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code. Users are recommended to upgrade to version 1.11.4 or 1.12.0, which fix this issue.
Credited to dbrugman.
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-47561
- https://lists.apache.org/thread/c2v7mhqnmq0jmbwxqq3r5jbj1xg43h5x
- https://github.com/apache/avro/pull/2934
- https://github.com/apache/avro/pull/2980
- https://github.com/apache/avro/commit/8f89868d29272e3afea2ff8de8c85cb81a57d900
- https://github.com/apache/avro/commit/f6b3bd7e50e6e09fedddb98c61558c022ba31285
- https://issues.apache.org/jira/browse/AVRO-3985
- https://thehackernews.com/2024/10/critical-apache-avro-sdk-flaw-allows.html
- https://www.openwall.com/lists/oss-security/2024/10/03/1
- https://security.netapp.com/advisory/ntap-20241011-0003
- https://github.com/advisories/GHSA-r7pg-v2c8-mfg3
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology