Is CVE-2025-33042 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-33042 being exploited in the wild.

How severe is CVE-2025-33042?

Medium severity, with a CVSS score of 4, published 13 February 2026.

Which products and versions are affected?

Apache Software Foundation Avro Java SDK <= 1.11.4, 1.12.0; org.apache.avro:avro-compiler (Maven) ECOSYSTEM:introduced=1.12.0,fixed=1.12.1; avro (PyPI) ECOSYSTEM:introduced=0,fixed=1.11.5.

Is there a fix for CVE-2025-33042?

Yes. org.apache.avro:avro-compiler (Maven): upgrade to 1.12.1 or later; avro (PyPI): upgrade to 1.11.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-33042 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-33042?

Check whether you run Apache Software Foundation Avro Java SDK, org.apache.avro:avro-compiler (Maven) or avro (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-33042: Apache Avro Java SDK code injection in avro-compiler

Q: Is there a fix for CVE-2025-33042?

Yes. org.apache.avro:avro-compiler (Maven): upgrade to 1.12.1 or later; avro (PyPI): upgrade to 1.11.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2025-33042 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2025-33042?

Check whether you run Apache Software Foundation Avro Java SDK, org.apache.avro:avro-compiler (Maven) or avro (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-33042 · Severity: medium · CVSS 4 · Published 2026-02-13

The Apache Avro Java SDK, a tool used for data serialization and exchange in Java applications, contains a vulnerability that allows for unauthorized code injection. If an application processes a specially crafted, untrusted data schema, an attacker could potentially execute malicious code or modify system data. This could lead to unauthorized changes in application behavior or data integrity issues.

Technologies: avro (PyPI). Vendors: Apache Software Foundation, Maven, PyPI.

Quick answers

Is CVE-2025-33042 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-33042 being exploited in the wild.
How severe is CVE-2025-33042?: Medium severity, with a CVSS score of 4, published 13 February 2026.
Which products and versions are affected?: Apache Software Foundation Avro Java SDK <= 1.11.4, 1.12.0; org.apache.avro:avro-compiler (Maven) ECOSYSTEM:introduced=1.12.0,fixed=1.12.1; avro (PyPI) ECOSYSTEM:introduced=0,fixed=1.11.5.
Is there a fix for CVE-2025-33042?: Yes. org.apache.avro:avro-compiler (Maven): upgrade to 1.12.1 or later; avro (PyPI): upgrade to 1.11.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-33042 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-33042?: Check whether you run Apache Software Foundation Avro Java SDK, org.apache.avro:avro-compiler (Maven) or avro (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.apache.avro:avro-compiler (Maven): upgrade to 1.12.1 or later

# set org.apache.avro:avro-compiler to 1.12.1 in your pom.xml or build.gradle

avro (PyPI): upgrade to 1.11.5 or later
```
pip install "avro>=1.11.5"
```

Technical details

A Code Injection vulnerability (CWE-94) exists in the Apache Avro Java SDK's avro-compiler component. The flaw is triggered during the generation of Java records from untrusted or malicious Avro schemas. An attacker can provide a specially crafted schema that, when processed by the SDK, results in the execution of arbitrary code or improper code generation. The vulnerability is reachable over the network without authentication or user interaction. Users should upgrade to version 1.11.5 or 1.12.1 to mitigate this risk.

Affected products

Apache Avro Java SDK <= 1.11.4, 1.12.0

Identifiers

CVE-2025-33042
GHSA-rp46-r563-jrc7
PYSEC-2026-26

Timeline

2026-02-13: disclosed
2026-02-13: advisory
2026-02-13: patched: Patched in 1.11.5 and 1.12.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.