Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Apache Avro Compiler could let attackers run code
published 2 months ago
Summary
The Avro compiler component used for data serialization can be tricked into executing malicious code. An update released by TuxCare fixes the issue in version 1.10.2-tuxcare.4. Apply this updated package to all affected Avro components as soon as possible.
What to do
- Update apache org.apache.avro:avro to version 1.10.2-tuxcare.4.
- Update apache org.apache.avro:avro-archetypes-parent to version 1.10.2-tuxcare.4.
- Update apache org.apache.avro:avro-codegen-test to version 1.10.2-tuxcare.4.
- Update apache org.apache.avro:avro-compiler to version 1.10.2-tuxcare.4.
- Update apache org.apache.avro:avro-grpc to version 1.10.2-tuxcare.4.
- Update apache org.apache.avro:avro-integration-test to version 1.10.2-tuxcare.4.
- Update apache org.apache.avro:avro-ipc to version 1.10.2-tuxcare.4.
- Update apache org.apache.avro:avro-ipc-jetty to version 1.10.2-tuxcare.4.
- Update apache org.apache.avro:avro-ipc-netty to version 1.10.2-tuxcare.4.
- Update apache org.apache.avro:avro-mapred to version 1.10.2-tuxcare.4.
- Update apache org.apache.avro:avro-maven-plugin to version 1.10.2-tuxcare.4.
- Update apache org.apache.avro:avro-parent to version 1.10.2-tuxcare.4.
- Update apache org.apache.avro:avro-perf to version 1.10.2-tuxcare.4.
- Update apache org.apache.avro:avro-protobuf to version 1.10.2-tuxcare.4.
- Update apache org.apache.avro:avro-service-archetype to version 1.10.2-tuxcare.4.
- Update apache org.apache.avro:avro-test-custom-conversions to version 1.10.2-tuxcare.4.
- Update apache org.apache.avro:avro-thrift to version 1.10.2-tuxcare.4.
- Update apache org.apache.avro:avro-tools to version 1.10.2-tuxcare.4.
- Update apache org.apache.avro:avro-toplevel to version 1.10.2-tuxcare.4.
- Update apache org.apache.avro:trevni-avro to version 1.10.2-tuxcare.4.
- Update apache org.apache.avro:trevni-core to version 1.10.2-tuxcare.4.
- Update apache org.apache.avro:trevni-doc to version 1.10.2-tuxcare.4.
- Update apache org.apache.avro:trevni-java to version 1.10.2-tuxcare.4.
- Update org.apache.avro:avro-codegen-test to version 1.10.2-tuxcare.4.
- Update org.apache.avro:avro-compiler to version 1.10.2-tuxcare.4.
- Update org.apache.avro:avro-maven-plugin to version 1.10.2-tuxcare.4.
- Update org.apache.avro:avro-tools to version 1.10.2-tuxcare.4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:Maven | apache | org.apache.avro:avro |
>= 1.10.2, < 1.10.2-tuxcare.4 Fix: upgrade to 1.10.2-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.avro:avro-archetypes-parent |
>= 1.10.2, < 1.10.2-tuxcare.4 Fix: upgrade to 1.10.2-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.avro:avro-codegen-test |
>= 1.10.2, < 1.10.2-tuxcare.4 Fix: upgrade to 1.10.2-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.avro:avro-compiler |
>= 1.10.2, < 1.10.2-tuxcare.4 Fix: upgrade to 1.10.2-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.avro:avro-grpc |
>= 1.10.2, < 1.10.2-tuxcare.4 Fix: upgrade to 1.10.2-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.avro:avro-integration-test |
>= 1.10.2, < 1.10.2-tuxcare.4 Fix: upgrade to 1.10.2-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.avro:avro-ipc |
>= 1.10.2, < 1.10.2-tuxcare.4 Fix: upgrade to 1.10.2-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.avro:avro-ipc-jetty |
>= 1.10.2, < 1.10.2-tuxcare.4 Fix: upgrade to 1.10.2-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.avro:avro-ipc-netty |
>= 1.10.2, < 1.10.2-tuxcare.4 Fix: upgrade to 1.10.2-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.avro:avro-mapred |
>= 1.10.2, < 1.10.2-tuxcare.4 Fix: upgrade to 1.10.2-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.avro:avro-maven-plugin |
>= 1.10.2, < 1.10.2-tuxcare.4 Fix: upgrade to 1.10.2-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.avro:avro-parent |
>= 1.10.2, < 1.10.2-tuxcare.4 Fix: upgrade to 1.10.2-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.avro:avro-perf |
>= 1.10.2, < 1.10.2-tuxcare.4 Fix: upgrade to 1.10.2-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.avro:avro-protobuf |
>= 1.10.2, < 1.10.2-tuxcare.4 Fix: upgrade to 1.10.2-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.avro:avro-service-archetype |
>= 1.10.2, < 1.10.2-tuxcare.4 Fix: upgrade to 1.10.2-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.avro:avro-test-custom-conversions |
>= 1.10.2, < 1.10.2-tuxcare.4 Fix: upgrade to 1.10.2-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.avro:avro-thrift |
>= 1.10.2, < 1.10.2-tuxcare.4 Fix: upgrade to 1.10.2-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.avro:avro-tools |
>= 1.10.2, < 1.10.2-tuxcare.4 Fix: upgrade to 1.10.2-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.avro:avro-toplevel |
>= 1.10.2, < 1.10.2-tuxcare.4 Fix: upgrade to 1.10.2-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.avro:trevni-avro |
>= 1.10.2, < 1.10.2-tuxcare.4 Fix: upgrade to 1.10.2-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.avro:trevni-core |
>= 1.10.2, < 1.10.2-tuxcare.4 Fix: upgrade to 1.10.2-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.avro:trevni-doc |
>= 1.10.2, < 1.10.2-tuxcare.4 Fix: upgrade to 1.10.2-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.avro:trevni-java |
>= 1.10.2, < 1.10.2-tuxcare.4 Fix: upgrade to 1.10.2-tuxcare.4
|
| TuxCare:Maven | – | org.apache.avro:avro-codegen-test |
>= 1.10.2, < 1.10.2-tuxcare.4 Fix: upgrade to 1.10.2-tuxcare.4
|
| TuxCare:Maven | – | org.apache.avro:avro-compiler |
>= 1.10.2, < 1.10.2-tuxcare.4 Fix: upgrade to 1.10.2-tuxcare.4
|
| TuxCare:Maven | – | org.apache.avro:avro-maven-plugin |
>= 1.10.2, < 1.10.2-tuxcare.4 Fix: upgrade to 1.10.2-tuxcare.4
|
| TuxCare:Maven | – | org.apache.avro:avro-tools |
>= 1.10.2, < 1.10.2-tuxcare.4 Fix: upgrade to 1.10.2-tuxcare.4
|
Original advisory text
TuxCare security update for org.apache.avro:avro-compiler (1 CVE)
TuxCare rebuilt org.apache.avro:avro-compiler to address 1 CVE. Fixed in 1.10.2-tuxcare.4.
Timeline
Published12 Aug 2026
Updated2 Nov 2026
First seen15 Oct 2026
Sources
CLSA-2026-1786540164 · OSV
Track software like this
Free during beta