CVE-2025-33042: Apache Avro

High severity, CVSS 7.3. EPSS: 0.6% chance of exploitation in the next 30 days.

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas. This issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0. Users are recommended to upgrade to version 1.12.1 or 1.11.5, which fix the issue.

Affected products

• Apache Avro: before 1.11.5 (fixed in 1.11.5); version 1.12.0 only

Published 2026-02-13. Last modified 2026-06-17.