CVE-2023-39410

24

FAUCET Score

CVE-2023-39410 is a high-severity deserialization vulnerability affecting Apache Avro Java SDK versions up to and including 1.11.2. This flaw allows an attacker to cause an out-of-memory condition by providing untrusted or corrupted data, leading to a denial of service. The vulnerability has a CVSS score of 7.5 and can be exploited remotely with low attack complexity, requiring no user interaction or privileges. There is currently no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this CVE.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		< 1.11.3CPE matchmatch criteria	cpe:2.3:a:apache:avro::::::-::*

CVSS Data

CVSS version used by this source: 3.1

7.5HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

Exploitability Score

3.9

Impact Score

3.6

CvssVersion

3.1

Exploit Intelligence

EPSS Score

1.77%

Probability of exploitation in next 30 days

EPSS Percentile

75.8%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.0177 is in the 59th percentile among its peer group of 51,551 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (36)

mavenpatch availablevia ghsa

Product: org.apache.avro:avroFixed in: 1.11.3

redhatpatch availablevia redhat_api

Product: Red Hat build of Apache Camel 4 for Quarkus 3

redhatpatch availablevia redhat_api

Product: Red Hat build of Quarkus 2.13.9.FinalFixed in: org.apache.avro/avro:1.11.3.redhat-00002

redhatpatch availablevia redhat_api

Product: Red Hat build of Quarkus 3.2.9.FinalFixed in: org.apache.avro/avro:1.11.3.redhat-00002

redhatpatch availablevia redhat_api

Product: Red Hat Fuse 7.12.1Fixed in: avro

redhatpatch availablevia redhat_api

Product: Red Hat Fuse 7.13.0Fixed in: avro

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7Fixed in: avro

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-apache-cxf-0:3.4.10-1.SP1_redhat_00001.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-avro-0:1.7.6-8.redhat_00003.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-jboss-annotations-api_1.3_spec-0:2.0.1-4.Final_redhat_00001.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-jboss-server-migration-0:1.7.2-12.Final_redhat_00013.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-jboss-xnio-base-0:3.7.13-1.Final_redhat_00001.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-log4j-jboss-logmanager-0:1.2.2-2.Final_redhat_00002.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-wildfly-0:7.3.11-4.GA_redhat_00002.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-wss4j-0:2.3.3-2.redhat_00001.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-xalan-j2-0:2.7.1-38.redhat_00015.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-xml-security-0:2.2.3-2.redhat_00001.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8Fixed in: eap7-avro-0:1.11.3-1.redhat_00001.1.el8eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9Fixed in: eap7-avro-0:1.11.3-1.redhat_00001.1.el9eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7Fixed in: eap7-avro-0:1.11.3-1.redhat_00001.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-h2database-0:1.4.197-3.redhat_00004.1.el7eap

redhatno patchvia redhat_api

Product: Red Hat build of Apicurio Registry 2Fixed in: avro

redhatno patchvia redhat_api

Product: Red Hat Integration Camel Quarkus 2Fixed in: avro

redhatno patchvia redhat_api

Product: Red Hat Single Sign-On 7Fixed in: avro

redhatend of lifevia redhat_api

Product: Red Hat build of Apache Camel for Spring Boot 3Fixed in: avro

redhatend of lifevia redhat_api

Product: Red Hat build of Debezium 2Fixed in: avro

Vendor Advisories (2)

mavenGHSA-rhrv-645h-fjfhhigh

Apache Avro Java SDK vulnerable to Improper Input Validation

redhatCVE-2023-39410Important

apache-avro: Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK

References

lists.apache.org / thread/q142wj99cwdd0jo5lvdoxzoymlqyjdds

Mailing ListVendor Advisory

security.netapp.com / advisory/ntap-20240621-0006

openwall.com / lists/oss-security/2023/09/29/6

Mailing ListThird Party Advisory