Executive brief
The Apache Avro Java SDK, a tool used for data serialization and exchange in Java applications, contains a vulnerability that allows for unauthorized code injection. If an application processes a specially crafted, untrusted data schema, an attacker could potentially execute malicious code or modify system data. This could lead to unauthorized changes in application behavior or data integrity issues.
Technical details
A Code Injection vulnerability (CWE-94) exists in the Apache Avro Java SDK's avro-compiler component. The flaw is triggered during the generation of Java records from untrusted or malicious Avro schemas. An attacker can provide a specially crafted schema that, when processed by the SDK, results in the execution of arbitrary code or improper code generation. The vulnerability is reachable over the network without authentication or user interaction. Users should upgrade to version 1.11.5 or 1.12.1 to mitigate this risk.
Affected products
- Apache Avro Java SDK <= 1.11.4, 1.12.0
Timeline
- 2026-02-13: disclosed
- 2026-02-13: advisory
- 2026-02-13: patched: Patched in 1.11.5 and 1.12.1