Skip to content
OpenAdvisories

Package · Go

github.com/iskorotkov/avro/v2

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • High 8.7
    CVE-2026-46385

    iskorotkov/avro: CPU Exhaustion in Avro Decoder

    iskorotkov/avro is a fast Go Avro codec. Prior to 2.33.0, the Avro array and map decoders looped over an attacker-controlled block-count value without checking the underlying reader's error state inside the loop body. Reader.ReadBlockHeader returns the count …

    iskorotkov avro github.com/hamba/avro/v2 github.com/iskorotkov/avro/v2 Go
  • High 8.7
    CVE-2026-46384

    iskorotkov/avro: Integer Overflow in Avro Decoder

    iskorotkov/avro is a fast Go Avro codec. Prior to 2.33.0, several Avro decoder paths read attacker-controlled 64-bit values from the wire format and either narrowed them to platform-sized int before bounds-checking, or summed them with overflow-prone signed-i…

    iskorotkov avro github.com/hamba/avro/v2 github.com/iskorotkov/avro/v2 Go
  • High 7.5
    GHSA-mx64-mj3q-7prj

    iskorotkov/avro: Denial-of-Service Vulnerability in Decoder

    # Memory Exhaustion via Unbounded Map Allocations in Avro Decoder ## Summary The Avro map decoder accepted attacker-controlled block-element counts from the wire format and grew the destination map without enforcing an upper bound. The slice decoder already h…

    github.com/hamba/avro/v2 github.com/iskorotkov/avro/v2 Go