PT-2024-6649 · Apache+1 · Apache Avro+5

Kostya Kortchinsky · Published 2024-10-03 · Updated 2026-05-18 · CVE-2024-47561

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions: Apache Avro versions 1.11.3 and previous versions Apache Avro versions prior to 1.11.4 Bamboo Data Center and Server versions 9.2.1, 9.6.0, and 10.0.0-rc3 Bitbucket Data Center and Server versions 8.6.0, 8.7.0, 8.8.0, 8.9.0, 8.10.0, 8.11.0, 8.12.0, 8.13.0, 8.14.0, 8.15.0, 8.16.0, 8.17.0, 8.18.0, 8.19.0, 9.0.0, 9.1.0, and 9.2.0 Confluence Data Center and Server version 6.5

Description: The vulnerability in the Apache Avro Java SDK is related to schema parsing, which allows bad actors to execute arbitrary code. This issue affects versions prior to 1.11.4 and can be exploited by unauthenticated attackers, potentially exposing assets in the environment to exploitation. The vulnerability has a low impact on confidentiality, integrity, and availability, and requires no user interaction. It is recommended to upgrade to version 1.11.4 or 1.12.0, which fix this issue.

Recommendations: For Apache Avro versions 1.11.3 and previous versions, upgrade to version 1.11.4 or 1.12.0. For Bamboo Data Center and Server versions 9.2.1, 9.6.0, and 10.0.0-rc3, upgrade to a release greater than or equal to 9.2.20, 9.6.8, or 10.0.3, respectively. For Bitbucket Data Center and Server versions 8.6.0, 8.7.0, 8.8.0, 8.9.0, 8.10.0, 8.11.0, 8.12.0, 8.13.0, 8.14.0, 8.15.0, 8.16.0, 8.17.0, 8.18.0, 8.19.0, 9.0.0, 9.1.0, and 9.2.0, upgrade to a release greater than or equal to 8.9.21 or 8.19.11, respectively. For Confluence Data Center and Server version 6.5, upgrade to a release greater than or equal to 7.19.30, 8.5.18, or 9.1.1, respectively. As a temporary workaround, consider disabling schema parsing in the Java SDK until a patch is available.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2024-07817

CLEANSTART-2026-JW30455

CLEANSTART-2026-KP10590

CLEANSTART-2026-MM00120

CLEANSTART-2026-SQ91016

CLEANSTART-2026-WG59699

CLEANSTART-2026-WK99982

CVE-2024-47561

GHSA-R7PG-V2C8-MFG3

OESA-2024-2227

RHSA-2024:10207

RHSA-2024:10208

RHSA-2024:7811

Affected Products

Apache Avro

Bamboo

Bamboo Server

Bitbucket

Bitbucket Server

Confluence

References · 216

• https://nvd.nist.gov/vuln/detail/CVE-2022-3510 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42577 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-40167 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42583 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-3505 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-3171 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-2047 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-24970 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-36479 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-5588 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-44981 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-58057 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-6763 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-22233 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-22569 · Security Note