Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK

CVE-2023-39410

What is CVE-2023-39410?

A vulnerability exists in the Apache Avro Java SDK that allows for memory consumption beyond intended limits during the deserialization of untrusted or corrupted data. This can lead to an out-of-memory condition, affecting the stability and performance of Java applications. Users are strongly advised to update to version 1.11.3 or later to mitigate this issue effectively.

References