CVE-2022-36125: apache software foundation apache avro Improper Input Validation
CVSS: 7.5v3.1HighModified
AliasesGHSA-3w5g-989p-35r8
Published 09-08-2022Last modified 06-03-2026
Vulnerability summary
CVE-2022-36125 is a high (CVSS 7.5) Improper Input Validation vulnerability in apache software foundation apache avro. EPSS estimates a 1.54% chance of exploitation in the next 30 days, higher than 74.5% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (CVE.org)EPSS score
1.54%
0%100%
Low · +0.03 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 09-08-2022PublishedVulnerability first disclosed.
- 06-03-2026Last modifiedVulnerability information updated.
Description
It is possible to crash (panic) an application by providing a corrupted data to be read. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to apache-avro version 0.14.0 which addresses this issue.
CVSS metrics
3 scores · 3 sources · 1 versionHigh 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 3 agree
- OSV · Crates.ioEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.54%
Chance of exploitation in the next 30 days
Percentile
75%
Versus all other CVEs
30-day change
+0.03 pp
From 1.51% on 18-09-2026
18-09-202618-10-2026
EPSS score1.54%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-190Integer Overflow or WraparoundThe product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
Affected systems
Apache1 product
- avro< 0.14.0
Apache software foundation1 product
- apache avro≥ unspecified, < 0.14.0
Crates.Io1 product
- apache-avro< 0.14.0
3 vendors · 3 products
References
3 links- lists.apache.org/thread/t1r5xz0pvhm4tosqopjpj6dz8zlsht07X Refsource MISCWEBMailing ListVendor Advisory
- github.com/a0x8o/avroPACKAGE