CVE-2024-47561

26

FAUCET Score

CVE-2024-47561 is a critical vulnerability in Apache Avro's Java SDK (versions 1.11.3 and earlier) that allows for arbitrary code execution through schema parsing, affecting various Apache and NetApp products. With a CVSS score of 7.3 (High), it presents a low-complexity network attack vector that can lead to partial loss of confidentiality, integrity, and availability. While there is no known active exploitation, public exploit code, or KEV listing, the vulnerability has garnered some community discussion and media coverage, indicating awareness. Users are strongly advised to upgrade to Avro 1.11.4 or 1.12.0 to mitigate this risk.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		< 1.11.4CPE matchmatch criteria	cpe:2.3:a:apache:avro::::::-::*
		Range not provided by sourceCPE matchmatch criteria	cpe:2.3:a:netapp:active_iq_unified_manager:-:::::linux::
		Range not provided by sourceCPE matchmatch criteria	cpe:2.3:a:netapp:active_iq_unified_manager:-:::::vmware_vsphere::
		Range not provided by sourceCPE matchmatch criteria	cpe:2.3:a:netapp:active_iq_unified_manager:-:::::windows::
		Range not provided by sourceCPE matchmatch criteria	cpe:2.3:a:netapp:brocade_san_navigator:-:::::::*

CVSS Data

CVSS version used by this source: 4.0

9.2CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

NETWORK

Attack Complexity

LOW

Attack Requirements

PRESENT

Privileges Required

NONE

User Interaction

NONE

VS Confidentiality

HIGH

VS Integrity

HIGH

VS Availability

HIGH

SS Confidentiality

NONE

SS Integrity

NONE

SS Availability

NONE

Exploit Maturity

NOT_DEFINED

CvssVersion

4.0

Exploit Intelligence

EPSS Score

3.26%

Probability of exploitation in next 30 days

EPSS Percentile

87.1%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.0326 is in the 77th percentile among its peer group of 51,506 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (35)

mavenpatch availablevia ghsa

Product: org.apache.avro:avroFixed in: 1.11.4

redhatpatch availablevia redhat_api

Product: Red Hat build of Apache Camel 4.4.3 for Spring BootFixed in: org.apache.avro/avro

redhatpatch availablevia redhat_api

Product: Red Hat build of Apache Camel 4 for Quarkus 3Fixed in: org.apache.avro/avro

redhatpatch availablevia redhat_api

Product: Red Hat build of Apicurio Registry 2.6.5 GAFixed in: org.apache.avro/avro

redhatpatch availablevia redhat_api

Product: Red Hat build of Quarkus 3.2Fixed in: org.apache.avro/avro

redhatpatch availablevia redhat_api

Product: Red Hat build of Quarkus 3.8Fixed in: org.apache.avro/avro

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application PlatformFixed in: org.apache.avro/avro:1.11.4.redhat-00001

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-apache-cxf-0:3.1.16-3.SP1_redhat_00001.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-avro-0:1.7.6-2.redhat_00003.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-bouncycastle-0:1.68.0-1.redhat_00005.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-h2database-0:1.4.197-2.redhat_00005.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-jackson-databind-0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-jboss-xnio-base-0:3.5.10-1.Final_redhat_00001.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-wildfly-0:7.1.8-2.GA_redhat_00002.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-xalan-j2-0:2.7.1-26.redhat_00015.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-apache-cxf-0:3.4.10-1.SP1_redhat_00001.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-avro-0:1.7.6-8.redhat_00003.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-h2database-0:1.4.197-3.redhat_00004.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-jboss-annotations-api_1.3_spec-0:2.0.1-4.Final_redhat_00001.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-jboss-marshalling-0:2.0.15-1.Final_redhat_00001.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-jboss-server-migration-0:1.7.2-12.Final_redhat_00013.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-jboss-xnio-base-0:3.7.13-1.Final_redhat_00001.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-log4j-jboss-logmanager-0:1.2.2-2.Final_redhat_00002.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-wildfly-0:7.3.11-4.GA_redhat_00002.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-wss4j-0:2.3.3-2.redhat_00001.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-xalan-j2-0:2.7.1-38.redhat_00015.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-xml-security-0:2.2.3-2.redhat_00001.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8Fixed in: eap7-avro-0:1.11.4-1.redhat_00001.1.el8eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9Fixed in: eap7-avro-0:1.11.4-1.redhat_00001.1.el9eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7Fixed in: eap7-avro-0:1.11.4-1.redhat_00001.1.el7eap

redhatpatch availablevia redhat_api

Product: RHINT Camel-K 1.10.8Fixed in: org.apache.avro/avro

redhatend of lifevia redhat_api

Product: Red Hat Fuse 7Fixed in: org.apache.avro/avro

redhatend of lifevia redhat_api

Product: Red Hat Single Sign-On 7Fixed in: org.apache.avro/avro

Vendor Advisories (2)

mavenGHSA-r7pg-v2c8-mfg3critical

Apache Avro Java SDK: Arbitrary Code Execution when reading Avro Data (Java SDK)

redhatCVE-2024-47561Critical

apache-avro: Schema parsing may trigger Remote Code Execution (RCE)

References

security.netapp.com / advisory/ntap-20241011-0003

Third Party Advisory

openwall.com / lists/oss-security/2024/10/03/1

Mailing ListThird Party Advisory

lists.apache.org / thread/c2v7mhqnmq0jmbwxqq3r5jbj1xg43h5x

Mailing ListVendor Advisory