CVE-2025-33042
High · 7.3CVSS
7.3
EPSS
0.7%
Published
Feb 13, 2026
CISA due date
—
The record
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas. This issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0. Users are recommended to upgrade to version 1.12.1 or 1.11.5, which fix the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.apache.avro:avro-compiler | 0 | 1.11.5 |
| Maven | org.apache.avro:avro-compiler | 1.12.0 | 1.12.1 |
| Chainguard | akhq | 0 | 0.26.0-r8 |
| Chainguard | apache-hop | 0 | 2.17.0-r0 |
| Chainguard | apache-hop-fips | 0 | 2.17.0-r0 |
| Chainguard | apache-pulsar | 0 | 4.1.3-r0 |
| Chainguard | celeborn-0.5 | 0 | 0.5.4-r17 |
| Chainguard | celeborn-0.6 | 0 | 0.6.2-r7 |
| Chainguard | druid | 0 | 36.0.0-r1 |
| Chainguard | kafbat-ui | 0 | 1.4.2-r3 |
| Chainguard | kafbat-ui-fips | 0 | 1.4.2-r2 |
| Chainguard | logstash-8.17 | 0 | 8.17.10-r11 |
| Chainguard | logstash-8.17-iamguarded-compat | 0 | 8.17.10-r11 |
| Chainguard | logstash-8.17-with-output-opensearch | 0 | 8.17.10-r11 |
| Chainguard | logstash-8.18 | 0 | 8.18.8-r10 |
| Chainguard | logstash-8.18-iamguarded-compat | 0 | 8.18.8-r10 |
| Chainguard | logstash-8.18-with-output-opensearch | 0 | 8.18.8-r10 |
| Chainguard | logstash-8.19 | 0 | 8.19.11-r0 |
| Chainguard | logstash-8.19-iamguarded-compat | 0 | 8.19.11-r0 |
| Chainguard | logstash-8.19-with-output-opensearch | 0 | 8.19.11-r0 |
| Chainguard | logstash-9.0 | 0 | 9.0.8-r10 |
| Chainguard | logstash-9.0-iamguarded-compat | 0 | 9.0.8-r10 |
| Chainguard | logstash-9.0-with-output-opensearch | 0 | 9.0.8-r10 |
| Chainguard | logstash-9.1 | 0 | 9.1.10-r0 |
| Chainguard | logstash-9.1-bitnami-compat | 0 | 9.1.10-r0 |
| Chainguard | logstash-9.1-iamguarded-compat | 0 | 9.1.10-r0 |
| Chainguard | logstash-9.1-with-output-opensearch | 0 | 9.1.10-r0 |
| Chainguard | logstash-9.2 | 0 | 9.2.5-r0 |
| Chainguard | logstash-9.2-iamguarded-compat | 0 | 9.2.5-r0 |
| Chainguard | logstash-9.2-with-output-opensearch | 0 | 9.2.5-r0 |
| Chainguard | logstash-9.3 | 0 | 9.3.0-r0 |
| Chainguard | logstash-9.3-iamguarded-compat | 0 | 9.3.0-r0 |
| Chainguard | logstash-9.3-with-output-opensearch | 0 | 9.3.0-r0 |
| Chainguard | pinot | 0 | 1.4.0-r1 |
| Chainguard | spark-3.5-scala-2.12 | 0 | 3.5.8-r2 |
| Chainguard | spark-3.5-scala-2.13 | 0 | 3.5.8-r2 |
| Chainguard | spark-4.0-scala-2.13 | 0 | 4.0.2-r0 |
| Chainguard | spark-4.1-scala-2.13 | 0 | 4.1.1-r4 |
| Chainguard | spark-fips-3.5-scala-2.12 | 0 | 3.5.4-r21 |
| Chainguard | spark-fips-3.5-scala-2.13 | 0 | 3.5.4-r21 |
| Chainguard | spark-fips-4.1-scala-2.13 | 0 | 4.1.1-r1 |
| Chainguard | wavefront-proxy | 0 | 13.9-r4 |
| Wolfi | akhq | 0 | 0.26.0-r8 |
| Wolfi | apache-pulsar | 0 | 4.1.3-r0 |
| Wolfi | celeborn-0.5 | 0 | 0.5.4-r17 |
| Wolfi | celeborn-0.6 | 0 | 0.6.2-r7 |
| Wolfi | druid | 0 | 36.0.0-r1 |
| Wolfi | logstash-9.1 | 0 | 9.1.10-r0 |
| Wolfi | logstash-9.1-bitnami-compat | 0 | 9.1.10-r0 |
| Wolfi | logstash-9.1-iamguarded-compat | 0 | 9.1.10-r0 |
| Wolfi | logstash-9.1-with-output-opensearch | 0 | 9.1.10-r0 |
| Wolfi | logstash-9.2 | 0 | 9.2.5-r0 |
| Wolfi | logstash-9.2-iamguarded-compat | 0 | 9.2.5-r0 |
| Wolfi | logstash-9.2-with-output-opensearch | 0 | 9.2.5-r0 |
| Wolfi | logstash-9.3 | 0 | 9.3.0-r0 |
| Wolfi | logstash-9.3-iamguarded-compat | 0 | 9.3.0-r0 |
| Wolfi | logstash-9.3-with-output-opensearch | 0 | 9.3.0-r0 |
| Wolfi | spark-3.5-scala-2.12 | 0 | 3.5.8-r2 |
| Wolfi | spark-3.5-scala-2.13 | 0 | 3.5.8-r2 |
| Wolfi | spark-4.0-scala-2.13 | 0 | 4.0.2-r0 |
| Wolfi | spark-4.1-scala-2.13 | 0 | 4.1.1-r4 |
| Wolfi | wavefront-proxy | 0 | 13.9-r4 |
Related vulnerabilities
- CVE-2026-33871 Netty is an asynchronous, event-driven network application framework. Also affects akhq
- CVE-2026-33870 Netty is an asynchronous, event-driven network application framework. Also affects akhq
- CVE-2026-24281 Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR)… Also affects akhq
- CVE-2026-24308 Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4… Also affects akhq
- CVE-2025-11143 The Jetty URI parser has some key differences to other common parsers when evaluating… Also affects akhq
- CVE-2026-1225 ACE vulnerability in configuration file processing by QOS.CH logback-core up to and… Also affects akhq
- CVE-2025-67735 Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder Also affects akhq
- CVE-2025-11226 ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up… Also affects akhq