Maven/org.apache.avro:avro CVE-2023-39410: high 7.5, EPSS 2.22%

Apache Avro Java SDK vulnerable to Improper Input Validation

Action: Upgrade org.apache.avro:avro to 1.11.3 or later.

Affected

Fixed versions

Sources

• osv: GHSA-rhrv-645h-fjfh
• https://nvd.nist.gov/vuln/detail/CVE-2023-39410
• https://github.com/apache/avro/commit/a12a7e44ddbe060c3dc731863cad5c15f9267828
• https://github.com/apache/avro
• https://github.com/pypa/advisory-database/tree/main/vulns/avro/PYSEC-2023-188.yaml
• https://issues.apache.org/jira/browse/AVRO-3819
• https://lists.apache.org/thread/q142wj99cwdd0jo5lvdoxzoymlqyjdds
• https://security.netapp.com/advisory/ntap-20240621-0006
• https://www.openwall.com/lists/oss-security/2023/09/29/6
• http://www.openwall.com/lists/oss-security/2023/09/29/6

CVE-2023-39410 · published 2023-09-29T18:30:22Z · modified 2026-09-10T03:50:03.249125764Z · JSON