CVE-2025-33042CWE-94

Apache Avro Java SDK: Code injection on Java generated code

High · published February 13, 2026

CVSS v3.1
7.3
EPSS
1%
Percentile
51.5
In the wild
Unconfirmed
What it is

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas.

This issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0.

Users are recommended to upgrade to version 1.12.1 or 1.11.5, which fix the issue.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00673 · 51.5th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-02-13T11:47Z
EPSS history
Timeline
  • 13 FEB 11:47Z
    Apache Avro Java SDK: Code injection on Java generated code
    cvelistv5