7.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-33042

CVE-2025-33042: Apache Avro Java SDK is Vulnerable to Code Injection

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas.

This issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0.

Users are recommended to upgrade to version 1.12.1 or 1.11.5, which fix the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-33042

CVE-2025-33042:

7.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.apache.avro:avro-compiler	maven	= 1.12.0	1.12.1
org.apache.avro:avro-compiler	maven	< 1.11.5	1.11.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the SpecificCompiler class of the Apache Avro Java SDK, which is responsible for generating Java code from Avro schemas. The analysis of the patch 84bc7322ca1c04ab4a8e4e708acf1e271541aac4 reveals two main issues that were fixed:

Code Injection via javaAnnotation Property: The javaAnnotations method in SpecificCompiler.java was modified to validate the contents of the javaAnnotation schema property. Previously, this property was treated as a raw string and injected directly into the generated Java file as an annotation. A malicious user could craft a schema with a javaAnnotation value like ... */ static { System.exit(0); } // to break out of the annotation context and inject arbitrary code. The patch introduces the isValidAsAnnotation method to strictly validate the annotation syntax, preventing this injection vector.
Javadoc Injection via doc Fields: The Velocity templates used for code generation (e.g., record.vm, enum.vm, protocol.vm) were updated to escape documentation fields (e.g., $schema.getDoc(), $field.doc()) using a new escapeForJavadoc method. Previously, the raw doc string was inserted directly into Javadoc comments. A malicious doc string like */ arbitrary code /* could be used to terminate the Javadoc comment and inject code or manipulate the generated documentation. The compile() method is the entry point that drives this template processing.

The primary vulnerable function is org.apache.avro.compiler.specific.SpecificCompiler.javaAnnotations as it directly handles the injectable javaAnnotation property. The overall compile() method of the SpecificCompiler is the entry point that orchestrates the entire vulnerable code generation process, including the processing of unescaped doc comments. During exploitation, a runtime profiler would likely show org.apache.avro.compiler.specific.SpecificCompiler.compile() as the top-level function call leading to the vulnerable code generation steps.

Vulnerable functions

org.apache.avro.compiler.specific.SpecificCompiler.javaAnnotations

lang/java/compiler/src/main/java/org/apache/avro/compiler/specific/SpecificCompiler.java

The `javaAnnotations` function processes the `javaAnnotation` property from an Avro schema. Before the patch, it would add the string value from this property directly into the generated Java source code without any validation. This allowed a malicious schema to inject arbitrary Java code, including static initializers, into the generated classes. The patch adds the `isValidAsAnnotation` check to prevent this.

org.apache.avro.compiler.specific.SpecificCompiler.compile

lang/java/compiler/src/main/java/org/apache/avro/compiler/specific/SpecificCompiler.java

The `compile` method orchestrates the code generation by processing Velocity templates. The templates were modified to escape documentation fields from the schema using `escapeForJavadoc`. Previously, unescaped documentation was inserted into Javadoc comments, which could allow an attacker to inject malicious content or code by crafting a doc string like `*/ arbitrary code /*` to break out of the comment.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.