{"id":"RHLW-2026-4051ab209e8865e6","summary":"Lightwell Security Advisory: avro-android 1.11.0.rhlw-00002","details":"Red Hat Lightwell has released org.apache.avro:avro-android 1.11.0.rhlw-00002 with backported fixes for CVE-2023-39410 and CVE-2024-47561.\n\nCVE-2023-39410: Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK\n\nCVE-2024-47561: Apache Avro Java SDK: Arbitrary Code Execution when reading Avro schema (Java SDK)\n\nThis patched artifact is a drop-in replacement for org.apache.avro:avro-android 1.11.0 from Maven Central.","modified":"2026-10-22T00:08:32.605570932Z","published":"2026-10-08T19:45:40Z","upstream":["CVE-2023-39410","CVE-2024-47561","GHSA-r7pg-v2c8-mfg3","GHSA-rhrv-645h-fjfh"],"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39410.json"},{"type":"ADVISORY","url":"https://lists.apache.org/thread/q142wj99cwdd0jo5lvdoxzoymlqyjdds"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39410"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-rhrv-645h-fjfh"},{"type":"WEB","url":"https://repo.maven.apache.org/maven2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47561.json"},{"type":"ADVISORY","url":"https://lists.apache.org/thread/c2v7mhqnmq0jmbwxqq3r5jbj1xg43h5x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47561"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-r7pg-v2c8-mfg3"}],"affected":[{"package":{"name":"org.apache.avro:avro-android","ecosystem":"Red Hat Lightwell:Maven","purl":"pkg:maven/org.apache.avro/avro-android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0.rhlw-00002"}]}],"versions":["1.11.0"],"database_specific":{"lightwell":{"backport_base_version":"1.11.0","remediated_version":"1.11.0.rhlw-00002","repository_url":"https://packages.redhat.com/lightwell/java/remediated/"},"source":"https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-4051ab209e8865e6.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"credits":[{"name":"Red Hat Lightwell","type":"REMEDIATION_DEVELOPER"}]}