Apache Avro Java SDK: Arbitrary Code Execution when reading Avro schema (Java SDK)
Priority MEDIUM 47CWE-502Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 12 fixed, 3 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.
Summary
Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code. Users are recommended to upgrade to version 1.11.4 or 1.12.0, which fix this issue.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.03256 88th percentileScored 2026-11-07
Fix Partial Apache Avro Java SDK (Apache Software Foundation): 1.11.4org.apache.avro:avro (Maven): 1.11.4Red Hat: 12 advisoriesRed Hat: 12 fixed, 3 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Avro Java SDK | before 1.11.4 | 1.11.4 | Patch available | CNA |
| — | org.apache.avro:avro (Maven) | before 1.11.4 | 1.11.4 | Patch available | GHSA-r7pg-v2c8-mfg3 |
- Apache Avro Java SDK VendorApache Affected before 1.11.4 Fixed in 1.11.4 Patch available CNA
- org.apache.avro:avro (Maven) Vendor— Affected before 1.11.4 Fixed in 1.11.4 Patch available GHSA-r7pg-v2c8-mfg3
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:avro:*:*:*:*:*:-:*:* | before 1.11.4 | Vulnerable | Apache |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:brocade_san_navigator:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:apache:avro:*:*:*:*:*:-:*:* Versions before 1.11.4 Vulnerable ·Apache
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:brocade_san_navigator:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Remediation
- Fix · CNA Apache Avro Java SDK (Apache Software Foundation) Fixed in 1.11.4
- Fix · GHSA-r7pg-v2c8-mfg3 org.apache.avro:avro (Maven) Fixed in 1.11.4 Advisory →
Red Hat 12 advisories
- RHSA-2024:10933 Released 2024-12-10 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 7.4.20 Security update
- Red Hat JBoss Enterprise Application Platform io.undertow.undertow-core-2.2.37.SP2-redhat-00001.jar, org.apache.avro.avro-1.11.4.redhat-00001.jar
- RHSA-2024:10207 Released 2024-11-25 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.3.11 Security update
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-apache-cxf-3.4.10-1.SP1_redhat_00001.1.el7eap, eap7-apache-cxf-rt-3.4.10-1.SP1_redhat_00001.1.el7eap, eap7-apache-cxf-services-3.4.10-1.SP1_redhat_00001.1.el7eap +44
- RHSA-2024:10208 Released 2024-11-25 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.1.8 on RHEL 7 security update
- Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-apache-cxf-3.1.16-3.SP1_redhat_00001.1.ep7.el7, eap7-apache-cxf-rt-3.1.16-3.SP1_redhat_00001.1.ep7.el7, eap7-apache-cxf-services-3.1.16-3.SP1_redhat_00001.1.ep7.el7 +14
Show 9 more Red Hat advisories
- RHSA-2024:8339 Released 2024-10-22 · Red Hat rating ImportantRed Hat Integration Camel K 1.10.8 release and security update.
- RHINT Camel-K 1.10.8
- RHSA-2024:8093 Released 2024-10-14 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4 security update
- Red Hat JBoss Enterprise Application Platform 7
- RHSA-2024:8064 Released 2024-10-14 · Red Hat rating CriticalRed Hat Build of Apache Camel 4.4.3 for Spring Boot security update.
- Red Hat build of Apache Camel 4.4.3 for Spring Boot
- RHSA-2024:7972 Released 2024-10-10 · Red Hat rating CriticalRed Hat Build of Apache Camel 4.4 for Quarkus 3.8 update is now available (RHBQ 3.8.6.SP1)
- Red Hat build of Apache Camel 4 for Quarkus 3
- RHSA-2024:7676 Released 2024-10-10 · Red Hat rating CriticalRed Hat build of Quarkus 3.2.12.SP1 Security Update
- Red Hat build of Quarkus Native builder
- RHSA-2024:7670 Released 2024-10-10 · Red Hat rating CriticalRed Hat build of Quarkus 3.8.6.SP1 Security Update
- Red Hat build of Quarkus Native builder
- RHSA-2024:7861 Released 2024-10-09 · Red Hat rating CriticalApicurio Registry (container images) release and security update [ 2.6.5 GA ]
- Red Hat build of Apicurio Registry 2.6.5 GA
- RHSA-2024:7811 Released 2024-10-08 · Red Hat rating CriticalRed Hat JBoss Enterprise Application Platform 7.4 Security update
- Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-avro-1.11.4-1.redhat_00001.1.el7eap
- Red Hat JBoss EAP 7.4 for RHEL 8 eap7-avro-1.11.4-1.redhat_00001.1.el8eap
- Red Hat JBoss EAP 7.4 for RHEL 9 eap7-avro-1.11.4-1.redhat_00001.1.el9eap
- RHSA-2024:7812 Released 2024-10-08 · Red Hat rating CriticalRed Hat JBoss Enterprise Application Platform 7.4 security update
- Red Hat JBoss Enterprise Application Platform 7
Vendor assessments
Red Hat
Red Hat rating: Critical. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Red Hat Single Sign-On 7 | Affected | No fix planned: Will not fix |
| Red Hat build of Apache Camel for Spring Boot 3 | Affected | No fix planned: Out of support scope |
| RHINT Camel-K 1.10.8 | Fixed | RHSA-2024:8339 |
| Red Hat JBoss EAP 7.4 for RHEL 7 Server | Fixed | RHSA-2024:7811 |
| Red Hat JBoss EAP 7.4 for RHEL 8 | Fixed | RHSA-2024:7811 |
| Red Hat JBoss EAP 7.4 for RHEL 9 | Fixed | RHSA-2024:7811 |
| Red Hat JBoss Enterprise Application Platform | Fixed | RHSA-2024:10933 |
| Red Hat JBoss Enterprise Application Platform 7 | Fixed | RHSA-2024:7812 |
| Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server | Fixed | RHSA-2024:10208 |
| Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server | Fixed | RHSA-2024:10207 |
| Red Hat build of Apache Camel 4 for Quarkus 3 | Fixed | RHSA-2024:7972 |
| Red Hat build of Apache Camel 4.4.3 for Spring Boot | Fixed | RHSA-2024:8064 |
| Red Hat build of Apicurio Registry 2.6.5 GA | Fixed | RHSA-2024:7861 |
| Red Hat build of Quarkus Native builder | Fixed | RHSA-2024:7676 |
Not affected: 9 products
- A-MQ Clients 2
- Logging Subsystem for Red Hat OpenShift
- Red Hat Build of Keycloak
- Red Hat Data Grid 8
- Red Hat JBoss Data Grid 7
- Red Hat JBoss Enterprise Application Platform
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat build of Debezium 2
Timeline
- 2026-10-02 Threatist record created from CVE-2024-47561
- 2026-10-03 Alias added: GHSA-r7pg-v2c8-mfg3
- 2026-10-20 Fix available: Red Hat build of Quarkus Native builder · Red Hat
References
Advisory 4
Other 9
- https://github.com/apache/avro/pull/2934
- https://github.com/apache/avro/pull/2980
- https://github.com/apache/avro/commit/8f89868d29272e3afea2ff8de8c85cb81a57d900
- https://github.com/apache/avro/commit/f6b3bd7e50e6e09fedddb98c61558c022ba31285
- https://github.com/apache/avro
- https://issues.apache.org/jira/browse/AVRO-3985
- https://security.netapp.com/advisory/ntap-20241011-0003
- https://thehackernews.com/2024/10/critical-apache-avro-sdk-flaw-allows.html
- https://www.openwall.com/lists/oss-security/2024/10/03/1
More Apache Avro vulnerabilities
- TI-2023-20549 Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK CVSS 3.1HIGH 7.5
- TI-2022-16548 Integer overflow when reading corrupted .avro file in Avro Rust SDK CVSS 3.1HIGH 7.5
- TI-2022-16547 Memory overconsumption in Avro Rust SDK CVSS 3.1HIGH 7.5
- TI-2025-24035 Apache Avro Java SDK: Code injection on Java generated code CVSS 3.1HIGH 7.3
- TI-2021-19111 Possible DOS vulnerabilities in C# Avro SDK CVSS 3.1HIGH 7.5
- TI-2022-16171 Denial of service while reading data in Avro Rust SDK CVSS 3.1HIGH 7.5
Sources
- CVE-2024-47561 · CVE Program
- CVE-2024-47561 · NVD
- FIRST EPSS
- GHSA-r7pg-v2c8-mfg3 · GitHub Advisory Database · CC BY 4.0
- CVE-2024-47561 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences