CVE-2025-33042

HIGH

Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions

Details

CVSS v3: 7.3
NVD published: 2026-02-13 12:16:07
EPSS: <0.1% probability · 22.4th percentile — 2026-03-30
Affected versions: cpe:2.3:a:apache:avro:*:*:*:*:*:-:*:* cpe:2.3:a:apache:avro:1.12.0:-:*:*:*:-:*:* cpe:2.3:a:apache:avro:1.12.0:rc0:*:*:*:-:*:* cpe:2.3:a:apache:avro:1.12.0:rc1:*:*:*:-:*:*
Summary: Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas. This issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0. Users are recommended to upgrade to version 1.12.1 or 1.11.5, which fix the issue.
Remediation: Not available in our cache.
Exploit info: Not available in our cache.

TopVuln sends digest emails with high-risk CVE picks across multiple authoritative sources—curated with EPSS and AI. Choose daily per-stream emails and optional weekly or monthly roundups.

Subscribe — free email digest or paid plan

Information is aggregated from multiple authoritative sources for convenience; verify with NVD and vendors before operational decisions.