Overview 7 matches · 3 in Waratek scope · 2 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
7matches
3in Waratek scope42.9%
2protected28.6%
0exploited0.0%
0CISA KEV0.0%
0public PoC0.0%
0EPSS ≥ 0.50.0%
Protected by Waratek
2
28.6%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
1
14.3%
Outside Waratek scope
0
0.0%
Not applicable
4
57.1%
Withdrawn CVE
0
0.0%
blocked by ARMR today
2
28.6%
partly blocked
0
0.0%
not blocked
5
71.4%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
7
100.0%
split by
peak 3 / quarter
Q1 221
Not applicable1
High1
not blocked1
No public exploit1
Q2 220
Q3 223
Not applicable3
High3
not blocked3
No public exploit3
Q4 220
Q1 230
Q2 230
Q3 231
Protected by Waratek1
High1
blocked by ARMR today1
No public exploit1
Q4 230
Q1 240
Q2 240
Q3 240
Q4 241
Protected by Waratek1
Critical1
blocked by ARMR today1
No public exploit1
Q1 250
Q2 250
Q3 250
Q4 250
Q1 261
No exploit published1
High1
not blocked1
No public exploit1
Q1 22Q3 22Q1 23Q3 23Q1 24Q3 24Q1 25Q3 25Q1 26
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2025-33042 | High | 2026-02-13 | No exploit published | No public exploit | Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas. This issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0. Users are recommended to upgrade to version 1.12.1 or 1.11.5, which fix the issue. |
| CVE-2024-47561 | Critical | 2024-10-03 | Protected by Waratek | No public exploit | Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code. Users are recommended to upgrade to version 1.11.4 or 1.12.0, which fix this issue. |
| CVE-2023-39410 | High | 2023-09-29 | Protected by Waratek | No public exploit | When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system. This issue affects Java applications using Apache Avro Java SDK up to and including 1.11.2. Users should update to apache-avro version 1.11.3 which addresses this issue. |
| CVE-2022-36125 | High | 2022-08-09 | Not applicable | No public exploit | It is possible to crash (panic) an application by providing a corrupted data to be read. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to apache-avro version 0.14.0 which addresses this issue. |
| CVE-2022-36124 | High | 2022-08-09 | Not applicable | No public exploit | It is possible for a Reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to apache-avro version 0.14.0 which addresses this issue. |
| CVE-2022-35724 | High | 2022-08-09 | Not applicable | No public exploit | It is possible to provide data to be read that leads the reader to loop in cycles endlessly, consuming CPU. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to apache-avro version 0.14.0 which addresses this issue. |
| CVE-2021-43045 | High | 2022-01-06 | Not applicable | No public exploit | A vulnerability in the .NET SDK of Apache Avro allows an attacker to allocate excessive resources, potentially causing a denial-of-service attack. This issue affects .NET applications using Apache Avro version 1.10.2 and prior versions. Users should update to version 1.11.0 which addresses this issue. |