What’s Vulnerable › Vulnerabilities

CVE-2024-47561: Apache Avro Java SDK: Arbitrary Code Execution when reading Avro schema (Java SDK)

• Severity: high (CVSS 7.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-10-03 · updated 2026-06-17
• Weakness: CWE-502

Description

Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code. Users are recommended to upgrade to version 1.11.4  or 1.12.0, which fix this issue.

Affected products

• Apache Software Foundation Apache Avro: before 1.11.4 — fixed in 1.11.4
• Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
• NetApp Brocade San Navigator: all versions

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Avro 1.11.4. Check the vendor advisory for mitigations.

References

• https://lists.apache.org/thread/c2v7mhqnmq0jmbwxqq3r5jbj1xg43h5x
• http://www.openwall.com/lists/oss-security/2024/10/03/1
• https://security.netapp.com/advisory/ntap-20241011-0003/

Get alerted when CVE-2024-47561 or the next vulnerability affects your stack