VulnSocial

CVE-2025-33042Disclosure(apache / avro)

LOWCVSS 7.3 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch apache avro systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas. This issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0. Users are recommended to upgrade to version 1.12.1 or 1.11.5, which fix the issue.

apache CVEsBack to dashboard
2.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-94

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • avro

Threat summary

  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 9 mentions across 6 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 3 signals
  • Technical details provided in 5 signals
  • Disclosure: 5 classified signals
  • General: 1 classified signal
  • Peaked 5d ago at 2 mentions (2026-02-13); latest day: 1
  • 9 total mentions across 6 days

Affected systems

Vendors
apache
Products
avro

1 version affected across 1 product

Deep dive

Activity timeline9 mentions / 6d
01122Mentions · 2026-02-13: 2Mentions · 2026-02-14: 1Mentions · 2026-02-16: 2Mentions · 2026-02-18: 1Mentions · 2026-03-11: 2Mentions · 2026-03-21: 1PoC Mentioned / Linked · 2026-02-16: 1Patch / Workaround · 2026-03-11: 2Patch / Workaround · 2026-03-21: 1Technical Details · 2026-02-13: 1Technical Details · 2026-02-14: 1Technical Details · 2026-02-16: 2Technical Details · 2026-02-18: 102-1302-1402-1602-1803-1103-21
Signal classification3 categories
Disclosure
555.6%
Patch
333.3%
General
111.1%
Referenced assets7 URLs
Classification over time
DateTotalLabels
2026-02-132
Disclosure1General1
2026-02-141
Disclosure1
2026-02-162
Disclosure2
2026-02-181
Disclosure1
2026-03-112
Patch2
2026-03-211
Patch1
Full discourse9 posts
  • Open Source Security mailing list@oss_security
    Disclosure

    CVE-2025-33042: Apache Avro Java SDK: Code injection on Java generated code https://www.openwall.com/lists/oss-security/2026/02/12/2 when generating specific records from untrusted Avro schemas. Severity: moderate

    Post summary

    A moderate‑severity code injection vulnerability (CVE‑2025‑33042) exists in the Apache Avro Java SDK when processing untrusted schemas; technical details are noted and a link to a mailing‑list discussion is provided.

    00052685
    4.4K followersView on X
  • GCP Weekly@gcpweekly
    Patch

    2.2.79-rocky9, 2.2.79-ubuntu22, 2.2.79-ubuntu22-arm 2.3.26-debian12, 2.3.26-ml-ubuntu22, 2.3.26-rocky9, 2.3.26-ubuntu22, 2.3.26-ubuntu22-arm Fixed CVEs CVE-2025-58057, CVE-2025-53864, CVE-2025-68161, CVE-2025-48924, and CVE-2025-33042. Upgraded Dataproc Metastore Proxy to 2/3

    Post summary

    The message announces that multiple CVEs (CVE-2025-58057, CVE-2025-53864, CVE-2025-68161, CVE-2025-48924, CVE-2025-33042) have been fixed in updated Dataproc Metastore Proxy packages.

    1000032
    1.8K followersView on X
  • GCP Weekly@gcpweekly
    Patch

    2.2.78-debian12, 2.2.78-rocky9, 2.2.78-ubuntu22, 2.2.78-ubuntu22-arm 2.3.25-debian12, 2.3.25-ml-ubuntu22, 2.3.25-rocky9, 2.3.25-ubuntu22, 2.3.25-ubuntu22-arm Fixed Fixed CVEs CVE-2025-58057, CVE-2025-53864, CVE-2025-68161, CVE-2025-48924 (partial), and CVE-2025-33042. 2/4

    Post summary

    The listed software versions have been updated, applying fixes for several CVEs; no additional exploit or PoC information is provided.

    1000098
    1.8K followersView on X
  • GCP Weekly@gcpweekly
    Patch

    CVE-2025-33042. Upgraded hms-proxy to v0.0.78 to fix CVEs. Feature Enabled Optimized Iceberg Vacuum by default in Spark for premium tier clusters 3/4

    Post summary

    The post announces that hms-proxy has been upgraded to version 0.0.78 to remediate CVEs, indicating a patch has been applied.

    10000108
    1.8K followersView on X
  • cvereports@_cvereports
    Disclosure

    CVE-2025-33042: Schema to Shell: Unpacking the Apache Avro Code Injection Vulnerability Apache Avro, the serialization backbone of the big data ecosystem, contained a critical code injection vulnerability in its Java SDK. The flaw allowed attackers to... https://cvereports.com/reports/CVE-2025-33042

    Post summary

    The report announces a critical code injection vulnerability in Apache Avro's Java SDK, but offers no PoC, exploit details, or mitigation information.

    0000148
    26 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    General

    CVE-2025-33042 CVE-2025-33042 https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-33042 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1

    Post summary

    The content merely repeats the CVE identifier and provides generic links to a vulnerability details page, without any specific technical or actionable information.

    0001046
    4.0K followersView on X
  • CRAC Learning - Tech@cracbot
    Disclosure

    CVE-2025-33042 (CVSS:7.3, HIGH) is Awaiting Analysis. Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific..https://nvd.nist.gov/vuln/detail/CVE-2025-33042 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre

    Post summary

    The tweet announces the CVE-2025-33042 vulnerability, providing its CVSS rating, type, and affected software, but no PoC, exploit, or patch details are supplied.

    0000043
    171 followersView on X
  • TRONCAL Yannick@ytroncal
    Disclosure

    CVE-2025-33042: Schema to Shell: Unpacking the Apache Avro Code Injection Vulnerability https://dev.to/cverports/cve-2025-33042-schema-to-shell-unpacking-the-apache-avro-code-injection-vulnerability-4263

    Post summary

    The article announces CVE‑2025‑33042, a code‑injection flaw in Apache Avro, but provides no details on exploitation, patching, or PoC evidence.

    0000028
    127 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2025-33042 Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas. This is… https://www.cve.org/CVERecord?id=CVE-2025-33042

    Post summary

    The post announces the new CVE-2025-33042, detailing a code injection flaw in Apache Avro’s Java SDK that triggers when processing untrusted Avro schemas.

    00000313
    56.5K followersView on X
CPE platform detail4 entries

4 of 4 entries

PartVendorProductVersionTarget SWTarget HW
Appapacheavro---
Appapacheavro1.12.0--
Appapacheavro1.12.0--
Appapacheavro1.12.0--

Explore more

Back to dashboardapache CVEsavro vulnerabilities