GO-2026-5046

The Avro array and map decoders loop over an attacker-controlled block-count value without checking the underlying reader's error state inside the loop body. Reader.ReadBlockHeader returns the count as a Go int, which is 64-bit on amd64 and arm64 targets. A producer can declare a block of up to math.MaxInt64 elements followed by EOF or any truncated payload, and the decoder will attempt that many no-op iterations before propagating the error.

The realistic ceiling is indefinite until the worker is killed externally. A single hostile payload pins a CPU core until the process is OOM-killed, deadline-cancelled, or terminated, resulting in a remote, unauthenticated denial-of-service.

The fix exits the loop on the first inner-decode error.

Database specific

{
    "review_status": "REVIEWED",
    "url": "https://pkg.go.dev/vuln/GO-2026-5046"
}

References

Credits

- Daniel Błażewicz
- Ivan Korotkov

Affected packages

Go / github.com/iskorotkov/avro/v2

Package

Name: github.com/iskorotkov/avro/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/iskorotkov/avro/v2

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.33.0

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/iskorotkov/avro/v2"
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-5046.json"

Go / github.com/hamba/avro/v2

Package

Name: github.com/hamba/avro/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/hamba/avro/v2

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/hamba/avro/v2"
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-5046.json"