CVE-2025-33042

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-33042
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-33042.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-33042
Aliases
Downstream
Related
Published
2026-02-13T11:47:03.783Z
Modified
2026-07-22T04:01:54.150969Z
Severity
  • 7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
Summary
Apache Avro Java SDK: Code injection on Java generated code
Details

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas.

This issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0.

Users are recommended to upgrade to version 1.12.1 or 1.11.5, which fix the issue.

Database specific 
{
    "cna_assigner": "apache",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/33xxx/CVE-2025-33042.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "last_affected": "1.11.4"
                },
                {
                    "introduced": "1.12.0"
                },
                {
                    "last_affected": "1.12.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "fixed": "1.11.4"
                }
            ],
            "source": "DESCRIPTION"
        }
    ],
    "cwe_ids": [
        "CWE-94"
    ]
}
References

Affected packages

Git / github.com/apache/avro

Affected ranges

Type
GIT
Repo
https://github.com/apache/avro
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
257db287e4cf3f3831013780e709226d4aa188d9
Introduced
8c27801dc8d42ccc00997f25c0b8f45f8d4a233e
Last affected
8c27801dc8d42ccc00997f25c0b8f45f8d4a233e
Database specific 
{
    "cpe": [
        "cpe:2.3:a:apache:avro:*:*:*:*:*:-:*:*",
        "cpe:2.3:a:apache:avro:1.12.0:-:*:*:*:-:*:*",
        "cpe:2.3:a:apache:avro:1.12.0:rc0:*:*:*:-:*:*",
        "cpe:2.3:a:apache:avro:1.12.0:rc1:*:*:*:-:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.11.5"
        },
        {
            "introduced": "1.12.0-NA"
        },
        {
            "last_affected": "1.12.0-NA"
        },
        {
            "introduced": "1.12.0-rc0"
        },
        {
            "last_affected": "1.12.0-rc0"
        },
        {
            "introduced": "1.12.0-rc1"
        },
        {
            "last_affected": "1.12.0-rc1"
        }
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ]
}

Affected versions

1.*
1.12.0-NA
release-1.*
release-1.11.0
release-1.11.0-rc1
release-1.11.0-rc2
release-1.11.1
release-1.11.1-rc1
release-1.11.2
release-1.11.2-rc1
release-1.11.3
release-1.11.3-rc1
release-1.11.4
release-1.11.5-RC0
release-1.12.0
release-1.12.0-rc0
release-1.12.0-rc1

Database specific

vanir_signatures_modified 
"2026-07-22T04:01:54Z"
vanir_signatures 
[
    {
        "target": {
            "file": "lang/java/compiler/src/test/java/org/apache/avro/compiler/specific/TestSpecificCompiler.java"
        },
        "id": "CVE-2025-33042-083a1499",
        "digest": {
            "line_hashes": [
                "291309800966843137947536545290032695159",
                "221037608479349514828638049023753841869",
                "315349996930919669934619115542338635801",
                "297219962978289013949108349949537781373",
                "272910421913207300507468130701630172916",
                "170200307531041902844093467846247043852",
                "257696663555733373567494095768409786221",
                "190924354717666708339553501730895217287",
                "224589439695360237174914848439162696008"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/apache/avro/commit/257db287e4cf3f3831013780e709226d4aa188d9"
    },
    {
        "target": {
            "function": "javaAnnotations",
            "file": "lang/java/compiler/src/main/java/org/apache/avro/compiler/specific/SpecificCompiler.java"
        },
        "id": "CVE-2025-33042-34c672b6",
        "digest": {
            "function_hash": "32788602440209861843884792714707363535",
            "length": 466.0
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/apache/avro/commit/257db287e4cf3f3831013780e709226d4aa188d9"
    },
    {
        "target": {
            "file": "lang/java/compiler/src/main/java/org/apache/avro/compiler/specific/SpecificCompiler.java"
        },
        "id": "CVE-2025-33042-9fc3eb30",
        "digest": {
            "line_hashes": [
                "70771956055940442514103611574301114154",
                "238903126193692026002511292991439891563",
                "300906517244693446487937585945550490448",
                "208827671120222188732267556602830336861",
                "46262050765424080087731599745530234117",
                "217116392064333751629977133211242667556",
                "330199537522653320165707225666721878474",
                "261400939099411121099566912930451212963",
                "258504385302819325578918495081448122546",
                "134725490339041595859278718042141308773",
                "256881393042175191513787229119012532126",
                "59618892000578408467121870609369899489",
                "81974687732621857746509896468957032518",
                "66398935291910999419497150480459600670",
                "188714196139622641091367112218836400048",
                "8682127004718845371017478450226688684",
                "70374232380200534640351897473476193966",
                "286133326394466185488886464481448443932",
                "185531377118408463826116287966828968498",
                "36989222978632851688226362820435483920",
                "297969883165229994553685187753389185344",
                "97752416601766057788212817459040229965",
                "130648611176324906569536615708418682764",
                "308067925127412434029531244835481049146",
                "48450229955444445478261254704838572703",
                "182922208540893286752063490037158396617",
                "221583899330277162497754445847262678530",
                "269191592085265711876533001616218781197",
                "143193421323882948310740841132108965602",
                "118098057086160394453256441589526704912",
                "135885473812845987448263785048101326937",
                "48842657684933011318605222139496299666",
                "96374062915015664357954062759603122110",
                "175991049823875534407563527860232381197"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/apache/avro/commit/257db287e4cf3f3831013780e709226d4aa188d9"
    },
    {
        "target": {
            "file": "lang/java/ipc/src/test/java/org/apache/avro/compiler/specific/TestSpecificCompiler.java"
        },
        "id": "CVE-2025-33042-a70e8b1e",
        "digest": {
            "line_hashes": [
                "119733935718277627224716802179174359496",
                "36013791008060821061663577733737481918",
                "229007013215136918271743442596489128921",
                "139173181423621862363735826218444014392"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/apache/avro/commit/257db287e4cf3f3831013780e709226d4aa188d9"
    },
    {
        "target": {
            "function": "escapeForJavadoc",
            "file": "lang/java/compiler/src/main/java/org/apache/avro/compiler/specific/SpecificCompiler.java"
        },
        "id": "CVE-2025-33042-a8dc4b74",
        "digest": {
            "function_hash": "270343127961230285353372754179074138435",
            "length": 80.0
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/apache/avro/commit/257db287e4cf3f3831013780e709226d4aa188d9"
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-33042.json"