org.apache.avro:avro (Maven) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Maven package org.apache.avro:avro, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (2)

• CVE-2023-39410 — CVSS 7.5 (high): When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead…
• CVE-2024-47561 — CVSS 7.3 (high): Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code. Users are…