{"action":"Upgrade org.apache.avro:avro-compiler to 1.11.5 (1.11.x) or 1.12.1 (1.12.x) or later.","affected":[{"fixed":"1.12.1","introduced":"1.12.0"},{"fixed":"1.11.5","introduced":"0"}],"component":"org.apache.avro:avro-compiler","cve_ids":["CVE-2025-33042"],"ecosystem":"Maven","epss":0.00673,"exploited":false,"fixed_versions":["1.12.1","1.11.5"],"ghsa_id":"GHSA-rp46-r563-jrc7","id":"tcs_01M5N9C57PEQXJ3DZ4TTHCJFF2","modified_at":"2026-09-10T03:50:35.786976440Z","published_at":"2026-02-13T12:31:21Z","references":["https://osv.dev/vulnerability/GHSA-rp46-r563-jrc7","https://nvd.nist.gov/vuln/detail/CVE-2025-33042","https://github.com/apache/avro/pull/3150","https://github.com/apache/avro/commit/84bc7322ca1c04ab4a8e4e708acf1e271541aac4","https://github.com/apache/avro","https://github.com/pypa/advisory-database/tree/main/vulns/avro/PYSEC-2026-26.yaml","https://issues.apache.org/jira/browse/AVRO-4053","https://lists.apache.org/thread/fy88wmgf1lj9479vrpt12cv8x73lroj1","https://security.snyk.io/vuln/SNYK-JAVA-ORGAPACHEAVRO-15282783","http://www.openwall.com/lists/oss-security/2026/02/12/2"],"severity":{"label":"high","score":7.3},"sources":[{"source":"osv","source_id":"GHSA-rp46-r563-jrc7","url":"https://osv.dev/vulnerability/GHSA-rp46-r563-jrc7"},{"source":"nvd","source_id":"CVE-2025-33042","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-33042"}],"summary":"Apache Avro Java SDK is Vulnerable to Code Injection"}