CVE-2024-47561

—

CVSS 4.0

9.2 critical

EPSS

3%p88

Published

Oct 3, 2024 (Oct 3, 2024)

Modified

Jun 17, 2026

Description

Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code. Users are recommended to upgrade to version 1.11.4 or 1.12.0, which fix this issue.

Vendors: apache netapp
Products: avro, active iq unified manager, brocade san navigator
Weakness: CWE-502
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

NVD CVE.org GitHub PoCs EPSS (3.3%)

In the news2 stories

Critical Apache Avro SDK Flaw Allows Remote Code Execution in Java Applications

The Hacker NewsOct 11, 04:52 UTC · Oct 11, 2024Vulnerability CVE-2024-47561

Critical Apache Avro SDK RCE flaw impacts Java applications

Security AffairsOct 7, 11:04 UTC · Oct 7, 2024Vulnerability CVE-2024-47561