An unauthenticated code injection vulnerability in the Apache Avro Java SDK poses a significant risk to applications processing untrusted schemas.

This is a code injection vulnerability (CWE-94) that occurs when the SDK generates records from untrusted Avro schemas. The vulnerability is exploitable by an unauthenticated remote attacker who can provide malicious schema inputs to the application.

The vulnerability carries a CVSS score of 7.3, indicating a high severity risk. Successful exploitation could allow an attacker to inject arbitrary code, potentially leading to unauthorized data access, system manipulation, or complete compromise of the host application. Given the ubiquity of Avro in data processing pipelines, this flaw presents a substantial threat to the integrity and availability of business critical systems.

Immediate Action: Upgrade the Apache Avro Java SDK to version 1.12.1 or 1.11.5 immediately to incorporate the necessary security patches.

Proactive Monitoring: Review application logs for unusual schema parsing patterns or unexpected execution behavior originating from external data sources.

Compensating Controls: Implement strict input validation and sanitization policies for all schemas processed by the application to prevent the ingestion of malicious or untrusted Avro content.

Public Exploit Available: Unknown.

The severity of this vulnerability necessitates immediate attention from engineering and security teams. Organizations relying on the Apache Avro Java SDK must prioritize updating their dependencies to the fixed versions (1.12.1 or 1.11.5) to eliminate the risk of code injection. Ensure that all development environments and production pipelines are audited to identify and remediate instances where untrusted schemas may be processed.