WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product avro✕
Overview 11 matches · 5 in Waratek scope · 3 protected · 0 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
11matches 5in Waratek scope45.5% 3protected27.3% 0exploited0.0% 0CISA KEV0.0% 1public PoC9.1% 0EPSS ≥ 0.50.0%
Protected by Waratek 3 27.3% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 2 18.2% Outside Waratek scope 0 0.0% Not applicable 6 54.5% Withdrawn CVE 0 0.0%
Critical 2 18.2% High 9 81.8% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 3 27.3% partly blocked 0 0.0% not blocked 8 72.7% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 2 18.2% Forecast only 0 0.0% No public exploit 9 81.8%
split by peak 3 / quarter
Not applicable: 6No exploit published: 2Protected by Waratek: 3 High: 9Critical: 2 not blocked: 8blocked by ARMR today: 3 No public exploit: 9Proof of concept only: 2
Q1 221 Not applicable1 High1 not blocked1 No public exploit1 Q2 220 Q3 223 Not applicable3 High3 not blocked3 No public exploit3 Q4 220 Q1 230 Q2 231 Not applicable1 High1 not blocked1 No public exploit1 Q3 232 Protected by Waratek1 Not applicable1 High2 blocked by ARMR today1 not blocked1 Proof of concept only1 No public exploit1 Q4 230 Q1 240 Q2 240 Q3 240 Q4 241 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1 Q1 250 Q2 252 Protected by Waratek1 No exploit published1 Critical1 High1 blocked by ARMR today1 not blocked1 Proof of concept only1 No public exploit1 Q3 250 Q4 250 Q1 261 No exploit published1 High1 not blocked1 No public exploit1
Q1 22Q3 22Q1 23Q3 23Q1 24Q3 24Q1 25Q3 25Q1 26
11 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2025-33042 High 2026-02-13 No exploit published No public exploit Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas. This issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0. Users are recommended to upgrade to version 1.12.1 or 1.11.5, which fix the issue.
CVE-2025-46762 High 2025-05-06 No exploit published No public exploit Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code. While 1.15.1 introduced a fix to restrict untrusted packages, the default setting of trusted packages still allows malicious classes from these packages to be executed. The exploit is only applicable if the client code of parquet-avro uses the "specific" or the "reflect" models deliberately for reading Parquet files. ("generic" model is not impacted) Users are recommended to upgrade to 1.15.2 or set the system property "org.apache.parquet.avro.SERIALIZABLE_PACKAGES" to an empty string on 1.15.1. Both are sufficient to fix the issue.
CVE-2025-30065 Critical 2025-04-01 Protected by Waratek Proof of concept only Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code Users are recommended to upgrade to version 1.15.1, which fixes the issue.
CVE-2024-47561 Critical 2024-10-03 Protected by Waratek No public exploit Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code. Users are recommended to upgrade to version 1.11.4  or 1.12.0, which fix this issue.
CVE-2023-39410 High 2023-09-29 Protected by Waratek No public exploit When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system. This issue affects Java applications using Apache Avro Java SDK up to and including 1.11.2. Users should update to apache-avro version 1.11.3 which addresses this issue.
CVE-2023-37475 High 2023-07-17 Not applicable Proof of concept only Hamba avro is a go lang encoder/decoder implementation of the avro codec specification. In affected versions a well-crafted string passed to avro's `github.com/hamba/avro/v2.Unmarshal()` can throw a `fatal error: runtime: out of memory` which is unrecoverable and can cause denial of service of the consumer of avro. The root cause of the issue is that avro uses part of the input to `Unmarshal()` to determine the size when creating a new slice and hence an attacker may consume arbitrary amounts of memory which in turn may cause the application to crash. This issue has been addressed in commit `b4a402f4` which has been included in release version `2.13.0`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2023-29708 High 2023-06-22 Not applicable No public exploit An issue was discovered in /cgi-bin/adm.cgi in WavLink WavRouter version RPT70HA1.x, allows attackers to force a factory reset via crafted payload.
CVE-2022-36125 High 2022-08-09 Not applicable No public exploit It is possible to crash (panic) an application by providing a corrupted data to be read. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to apache-avro version 0.14.0 which addresses this issue.
CVE-2022-36124 High 2022-08-09 Not applicable No public exploit It is possible for a Reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to apache-avro version 0.14.0 which addresses this issue.
CVE-2022-35724 High 2022-08-09 Not applicable No public exploit It is possible to provide data to be read that leads the reader to loop in cycles endlessly, consuming CPU. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to apache-avro version 0.14.0 which addresses this issue.
CVE-2021-43045 High 2022-01-06 Not applicable No public exploit A vulnerability in the .NET SDK of Apache Avro allows an attacker to allocate excessive resources, potentially causing a denial-of-service attack. This issue affects .NET applications using Apache Avro version 1.10.2 and prior versions. Users should update to version 1.11.0 which addresses this issue.