critical
CVE-2024-47561
apache-avro: Schema parsing may trigger Remote Code Execution (RCE)
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
GHSA9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Red Hat8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Julia9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Trivy's own label is CRITICAL. Rated critical by GHSA, Red Hat, Julia.
Description
Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code. Users are recommended to upgrade to version 1.11.4 or 1.12.0, which fix this issue.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| julia::Julia Ecosystem Security Advisories | Avro_jll | no fix listed |
| maven::GitHub Security Advisory Maven | org.apache.avro:avro | 1.11.4 |
| Red Hat | avro | no fix listed |
| chainguard | akhq, apache-nifi, celeborn-0.6 and 8 more | 0.25.1-r1 and 10 more |
| echo maven::Echo OSV | org.apache.avro:avro | 1.11.4 |
| minimos | apache-druid, apache-druid-fips | 38.0.0-r0 |
| seal maven::Seal Security Database | org.apache.avro:avro, org.apache.hadoop:hadoop-client-runtime, seal.sp1.org.apache.avro:avro and 1 more | 1.11.2+sp999, 1.9.2+sp2 and 3 more |
| wolfi | akhq, apache-nifi, celeborn-0.6 and 5 more | 0.25.1-r1 and 7 more |
Show all 29 entries from 8 sources
| Source | Package | Fixed in |
|---|---|---|
| julia::Julia Ecosystem Security Advisories | Avro_jll | no fix listed |
| maven::GitHub Security Advisory Maven | org.apache.avro:avro | 1.11.4 |
| Red Hat | avro | no fix listed |
| chainguard | akhq | 0.25.1-r1 |
| chainguard | apache-nifi | 2.3.0-r0 |
| chainguard | celeborn-0.6 | 0.6.3-r7 |
| chainguard | druid | 37.0.0-r56 |
| chainguard | hadoop-client-modules | 3.3.6-r8 |
| chainguard | logstash-8 | 8.17.3-r3 |
| chainguard | solr-9 | 9.10.1-r13 |
| chainguard | solr-fips-9 | 9.10.1-r1 |
| chainguard | tez | 0.10.4-r8 |
| chainguard | trino | 472-r0 |
| chainguard | wavefront-proxy | 13.7-r2 |
| echo maven::Echo OSV | org.apache.avro:avro | 1.11.4 |
| minimos | apache-druid | 38.0.0-r0 |
| minimos | apache-druid-fips | 38.0.0-r0 |
| seal maven::Seal Security Database | org.apache.avro:avro | 1.11.2+sp999, 1.9.2+sp2 |
| seal maven::Seal Security Database | org.apache.hadoop:hadoop-client-runtime | 3.4.0+sp2 |
| seal maven::Seal Security Database | seal.sp1.org.apache.avro:avro | 1.11.2+sp999, 1.9.2+sp999 |
| seal maven::Seal Security Database | seal.sp1.org.apache.hadoop:hadoop-client-runtime | 3.4.0+sp999 |
| wolfi | akhq | 0.25.1-r1 |
| wolfi | apache-nifi | 2.3.0-r0 |
| wolfi | celeborn-0.6 | 0.6.3-r7 |
| wolfi | druid | 37.0.0-r56 |
| wolfi | logstash-8 | 8.17.3-r3 |
| wolfi | tez | 0.10.4-r8 |
| wolfi | trino | 472-r0 |
| wolfi | wavefront-proxy | 13.7-r2 |
References
- http://www.openwall.com/lists/oss-security/2024/10/03/1
- https://access.redhat.com/security/cve/CVE-2024-47561
- https://advisory.echohq.com/cve/CVE-2024-47561
- https://github.com/advisories/GHSA-r7pg-v2c8-mfg3
- https://github.com/apache/avro
- https://github.com/apache/avro/commit/8f89868d29272e3afea2ff8de8c85cb81a57d900
- https://github.com/apache/avro/commit/f6b3bd7e50e6e09fedddb98c61558c022ba31285
- https://github.com/apache/avro/pull/2934
All 17 references
- https://github.com/apache/avro/pull/2980
- https://issues.apache.org/jira/browse/AVRO-3985
- https://lists.apache.org/thread/c2v7mhqnmq0jmbwxqq3r5jbj1xg43h5x
- https://nvd.nist.gov/vuln/detail/CVE-2024-47561
- https://security.netapp.com/advisory/ntap-20241011-0003
- https://security.netapp.com/advisory/ntap-20241011-0003/
- https://thehackernews.com/2024/10/critical-apache-avro-sdk-flaw-allows.html
- https://www.cve.org/CVERecord?id=CVE-2024-47561
- https://www.openwall.com/lists/oss-security/2024/10/03/1