Denial of Service Vulnerability in Go Avro Codec by iskorotkov

CVE-2026-46385

What is CVE-2026-46385?

The Go Avro codec by iskorotkov is susceptible to a denial of service vulnerability that occurs prior to version 2.33.0. The decoder's handling of Avro array and map structures allows an attacker to exploit a loop controlled by a block-count value derived from user input, without adequate error handling checks. This can lead to significant resource consumption on the server as the decoder may attempt to process extraordinarily large payloads, potentially causing the CPU core to be pinned indefinitely until the process is forcibly terminated. This flaw poses a risk of remote, unauthenticated denial of service, impacting the availability and reliability of the system. The issue has been resolved in version 2.33.0.

References