Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK
Priority MEDIUM 43CWE-502Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 11 fixed, 10 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.
Summary
When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system. This issue affects Java applications using Apache Avro Java SDK up to and including 1.11.2. Users should update to apache-avro version 1.11.3 which addresses this issue.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02221 82nd percentileScored 2026-11-08
Fix Partial Apache Avro Java SDK (Apache Software Foundation): 1.11.3org.apache.avro:avro (Maven): 1.11.3Red Hat: 11 advisoriesRed Hat: 11 fixed, 10 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Avro Java SDK | before 1.11.3 | 1.11.3 | Patch available | CNA |
| — | org.apache.avro:avro (Maven) | before 1.11.3 | 1.11.3 | Patch available | GHSA-rhrv-645h-fjfh |
- Apache Avro Java SDK VendorApache Affected before 1.11.3 Fixed in 1.11.3 Patch available CNA
- org.apache.avro:avro (Maven) Vendor— Affected before 1.11.3 Fixed in 1.11.3 Patch available GHSA-rhrv-645h-fjfh
Remediation
- Fix · CNA Apache Avro Java SDK (Apache Software Foundation) Fixed in 1.11.3
- Fix · GHSA-rhrv-645h-fjfh org.apache.avro:avro (Maven) Fixed in 1.11.3 Advisory →
Red Hat 11 advisories
- RHSA-2024:10207 Released 2024-11-25 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.3.11 Security update
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-apache-cxf-3.4.10-1.SP1_redhat_00001.1.el7eap, eap7-apache-cxf-rt-3.4.10-1.SP1_redhat_00001.1.el7eap, eap7-apache-cxf-services-3.4.10-1.SP1_redhat_00001.1.el7eap +44
- RHSA-2024:10208 Released 2024-11-25 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.1.8 on RHEL 7 security update
- Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-apache-cxf-3.1.16-3.SP1_redhat_00001.1.ep7.el7, eap7-apache-cxf-rt-3.1.16-3.SP1_redhat_00001.1.ep7.el7, eap7-apache-cxf-services-3.1.16-3.SP1_redhat_00001.1.ep7.el7 +14
- RHSA-2024:3354 Released 2024-05-23 · Red Hat rating ImportantRed Hat Fuse 7.13.0 release and security update
- Red Hat Fuse 7.13.0
Show 8 more Red Hat advisories
- RHSA-2023:7700 Released 2023-12-07 · Red Hat rating ImportantRed Hat build of Quarkus 2.13.9 release and security update
- Red Hat build of Quarkus 2.13.9
- RHSA-2023:7638 Released 2023-12-04 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.14 on RHEL 8 security update
- Red Hat JBoss EAP 7.4 for RHEL 8 eap7-activemq-artemis-2.16.0-17.redhat_00051.1.el8eap, eap7-activemq-artemis-cli-2.16.0-17.redhat_00051.1.el8eap, eap7-activemq-artemis-commons-2.16.0-17.redhat_00051.1.el8eap +47
- RHSA-2023:7641 Released 2023-12-04 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.14 security update
- Red Hat JBoss Enterprise Application Platform com.google.guava.guava-32.1.1.jre-redhat-00001.jar, io.netty.netty-codec-http2-4.1.94.Final-redhat-00003.jar, io.undertow.undertow-core-2.2.28.SP1-redhat-00001.jar +4
- RHSA-2023:7637 Released 2023-12-04 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.14 on RHEL 7 security update
- Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-activemq-artemis-2.16.0-17.redhat_00051.1.el7eap, eap7-activemq-artemis-cli-2.16.0-17.redhat_00051.1.el7eap, eap7-activemq-artemis-commons-2.16.0-17.redhat_00051.1.el7eap +47
- RHSA-2023:7639 Released 2023-12-04 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.14 on RHEL 9 security update
- Red Hat JBoss EAP 7.4 for RHEL 9 eap7-activemq-artemis-2.16.0-17.redhat_00051.1.el9eap, eap7-activemq-artemis-cli-2.16.0-17.redhat_00051.1.el9eap, eap7-activemq-artemis-commons-2.16.0-17.redhat_00051.1.el9eap +47
- RHSA-2023:7617 Released 2023-11-30 · Red Hat rating ImportantRed Hat Build of Apache Camel for Quarkus 3.2.0 release (RHBQ 3.2.9.Final)
- Red Hat build of Apache Camel 4 for Quarkus 3
- RHSA-2023:7612 Released 2023-11-30 · Red Hat rating ImportantRed Hat build of Quarkus 3.2.9 release and security update
- Red Hat build of Quarkus 3.2.9.Final io.quarkus.quarkus-smallrye-graphql-3.2.9.Final-redhat-00002.jar, org.apache.avro.avro-1.11.3.redhat-00002.jar, org.xerial.snappy.snappy-java-1.1.10.5-redhat-00001.jar
- RHSA-2023:7247 Released 2023-11-15 · Red Hat rating CriticalRed Hat Fuse 7.12.1 release and security update
- Red Hat Fuse 7.12.1
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Integration Camel Quarkus 2 | Affected | No fix yet |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Virtualization 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
| Red Hat Single Sign-On 7 | Affected | No fix yet |
| Red Hat build of Apache Camel for Spring Boot 3 | Affected | No fix planned: Will not fix |
| Red Hat build of Apicurio Registry 2 | Affected | No fix yet |
| Red Hat build of Debezium 2 | Affected | No fix planned: Will not fix |
| streams for Apache Kafka | Affected | No fix planned: Out of support scope |
| Red Hat Fuse 7.12.1 | Fixed | RHSA-2023:7247 |
| Red Hat Fuse 7.13.0 | Fixed | RHSA-2024:3354 |
| Red Hat JBoss EAP 7.4 for RHEL 7 Server | Fixed | RHSA-2023:7637 |
| Red Hat JBoss EAP 7.4 for RHEL 8 | Fixed | RHSA-2023:7638 |
| Red Hat JBoss EAP 7.4 for RHEL 9 | Fixed | RHSA-2023:7639 |
| Red Hat JBoss Enterprise Application Platform | Fixed | RHSA-2023:7641 |
| Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server | Fixed | RHSA-2024:10208 |
| Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server | Fixed | RHSA-2024:10207 |
| Red Hat build of Apache Camel 4 for Quarkus 3 | Fixed | RHSA-2023:7617 |
| Red Hat build of Quarkus 2.13.9 | Fixed | RHSA-2023:7700 |
| Red Hat build of Quarkus 3.2.9.Final | Fixed | RHSA-2023:7612 |
Not affected: 13 products
- A-MQ Clients 2
- Logging Subsystem for Red Hat OpenShift
- Red Hat Data Grid 8
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Integration Camel K 1
- Red Hat JBoss EAP 7.4 for RHEL 7 Server
- Red Hat JBoss EAP 7.4 for RHEL 8
- Red Hat JBoss EAP 7.4 for RHEL 9
- Red Hat JBoss Enterprise Application Platform
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat build of Quarkus 3.2.9.Final
Timeline
- 2026-10-02 Threatist record created from CVE-2023-39410
- 2026-10-03 Alias added: GHSA-rhrv-645h-fjfh
- 2026-10-09 Fix available: Red Hat build of Quarkus 2.13.9 · Red Hat
References
Advisory 3
Other 7
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://github.com/apache/avro/commit/a12a7e44ddbe060c3dc731863cad5c15f9267828
- https://github.com/apache/avro
- https://github.com/pypa/advisory-database/tree/main/vulns/avro/PYSEC-2023-188.yaml
- https://issues.apache.org/jira/browse/AVRO-3819
- https://security.netapp.com/advisory/ntap-20240621-0006
- http://www.openwall.com/lists/oss-security/2023/09/29/6
More Apache Avro vulnerabilities
- TI-2024-31848 Apache Avro Java SDK: Arbitrary Code Execution when reading Avro schema (Java SDK) CVSS 4.0CRITICAL 9.2
- TI-2022-16548 Integer overflow when reading corrupted .avro file in Avro Rust SDK CVSS 3.1HIGH 7.5
- TI-2022-16547 Memory overconsumption in Avro Rust SDK CVSS 3.1HIGH 7.5
- TI-2025-24035 Apache Avro Java SDK: Code injection on Java generated code CVSS 3.1HIGH 7.3
- TI-2021-19111 Possible DOS vulnerabilities in C# Avro SDK CVSS 3.1HIGH 7.5
- TI-2022-16171 Denial of service while reading data in Avro Rust SDK CVSS 3.1HIGH 7.5
Sources
- CVE-2023-39410 · CVE Program
- CVE-2023-39410 · NVD
- FIRST EPSS
- GHSA-rhrv-645h-fjfh · GitHub Advisory Database · CC BY 4.0
- CVE-2023-39410 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences