Apache Avro Java SDK 存在代码注入漏洞

An attacker exploiting this vulnerability could craft a malicious Avro schema that, when processed by the Avro compiler, results in the execution of arbitrary code on the system. This could lead to complete system compromise, data exfiltration, or denial of service. The impact is particularly severe in environments where Avro schemas are sourced from untrusted origins, such as external APIs or user-provided configurations. The ability to inject code directly into the generated Java code makes this a high-risk vulnerability, similar in potential impact to other code injection flaws.

Applications and systems that rely on the Apache Avro Java SDK to process Avro data from untrusted sources are at risk. This includes data pipelines, streaming applications, and systems that integrate with external APIs using Avro schemas. Organizations using older versions of Avro in production environments, particularly those with limited schema validation, are especially vulnerable.

• java / server:

find /path/to/avro/jars -name "avro-compiler-*.jar"

• java / supply-chain: Check for the presence of vulnerable Avro compiler JAR files in your application dependencies using dependency scanning tools. • generic web: Inspect Avro schema files for suspicious code patterns or unusual data structures that could be indicative of malicious intent.

1. 2026-02-13Disclosure

   disclosure

1. 已保留2025-04-15
2. 发布日期2026-02-13
3. 修改日期2026-02-19
4. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2025-33042 is to upgrade to a patched version of the Apache Avro Java SDK. Upgrade to version 1.12.1 or 1.11.5. If upgrading immediately is not possible, consider implementing input validation on Avro schemas to prevent the processing of potentially malicious content. While not a complete solution, this can reduce the attack surface. Review any existing schema validation rules and strengthen them to reject schemas containing suspicious patterns. After upgrading, confirm the fix by attempting to compile a known malicious schema and verifying that it fails to generate executable code.