Description

Upgrades org.apache.avro from 1.11.4 to 1.11.5 to remediate CVE-2025-33042.

CVE Details

CVE-2025-33042 — Improper Control of Generation of Code (Code Injection) in Apache Avro Java SDK

• Affected versions: All Apache Avro Java SDK versions through 1.11.4, and version 1.12.0
• Fixed in: 1.11.5 (or 1.12.1 in the 1.12 line)
• Description: When generating Java source code from Avro schemas containing specially crafted field or type names sourced from untrusted input, the SDK fails to neutralize special elements, allowing code injection into the generated output.

Release note

Upgrades org.apache.avro from 1.11.4 to 1.11.5 to remediate CVE-2025-33042.

Key changed/added classes in this PR

• Top Level pom.xml

This PR has:

• been self-reviewed.
  • using the concurrency checklist (Remove this item if the PR doesn't have any relation to concurrency.)
• added documentation for new or modified features or behaviors.
• a release note entry in the PR description.
• added Javadocs for most classes and all non-trivial methods. Linked related entities via Javadoc links.
• added or updated version, license, or notice information in licenses.yaml
• added comments explaining the "why" and the intent of the code wherever would not be obvious for an unfamiliar reader.
• added unit tests or modified existing tests to cover new code paths, ensuring the threshold for code coverage is met.
• added integration tests.
• been tested in a test Druid cluster.