Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2026-46385 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

iskorotkov/avro is a fast Go Avro codec. Prior to 2.33.0, the Avro array and map decoders looped over an attacker-controlled block-count value without checking the underlying reader's error state inside the loop body. Reader.ReadBlockHeader returns the count as a Go int, which is 64-bit on amd64 / arm64 targets — so a producer can declare a block of up to math.MaxInt64 (~9.2 × 10¹⁸) elements followed by EOF (or any truncated payload), and the decoder will attempt that many no-op iterations before propagating the error. The realistic ceiling is "indefinite until the worker is killed externally" — a single hostile payload pins a CPU core until the process is OOM-killed, deadline-cancelled, or terminated. Remote, unauthenticated denial-of-service. This vulnerability is fixed in 2.33.0.

Metrics

CVSS 3.x Severity and Vector Strings:

NDDVolerionCVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA: redhat-SADPCVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://access.redhat.com/errata/RHSA-2026:30651 redhat-SADP
https://access.redhat.com/errata/RHSA-2026:41030 redhat-SADP
https://access.redhat.com/errata/RHSA-2026:41064 redhat-SADP
https://access.redhat.com/errata/RHSA-2026:42852 redhat-SADP
https://access.redhat.com/errata/RHSA-2026:44622 redhat-SADP

see all 15 references

Weakness Enumeration

CWE-IDCWE NameSource
CWE-400Uncontrolled Resource Consumption[email protected]
CWE-835Loop with Unreachable Exit Condition ('Infinite Loop')redhat-SADP

Affected Products

ProductVersions
iskorotkov/avro
<= v2.31.0 (semver)
< v2.33.0 (semver)

CPE

  • No CPEs found in CPE dictionary for this product.

Remediation

  • Upgrade: v2.33.0moderate effort
  • Mitigation:low effort

    Set explicit allocation caps for the decoder: ```go cfg := avro.Config{ MaxByteSliceSize: 102_400, MaxSliceAllocSize: 10_000, MaxMapAllocSize: 10_000, }.Freeze() decoder := cfg.NewDecoder(schema, reader) ``` `MaxMapAllocSize` is new in `v2.33.0` and opt-in (default zero, which leaves the previous unbounded behavior). Without setting it, a producer that ships a `math.MaxInt64`-count block still consumes the corresponding memory and CPU.

  • Mitigation:low effort

    Implement application-level structural workarounds such as: - Per-request decode timeouts - Isolated decoder workers under CPU quotas - Rejection of payloads whose advertised block count exceeds a known sane bound for your schema

Change History

29 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2026-46385
NVD Published Date:
May 29, 2026
NVD Last Modified:
Sep 9, 2026
Source:
[email protected]
CVE-2026-46385 Details - Not Deferred