GO-2026-5047

Several Avro decoder paths read attacker-controlled 64-bit values from the wire format and either narrowed them to platform-sized int before bounds-checking, or summed them with overflow-prone signed-int arithmetic. On 32-bit targets, the truncation paths can silently bypass byte-slice limits, select the wrong union branch, or hit a negative-make panic via wrap.

Three sub-issues are not 32-bit-specific: cumulative-size arithmetic overflow in array and map decoders, negation of MinInt in block-header handling, and negative size in block reads. All three panic or bypass caps on any platform, giving an attacker a denial-of-service primitive. Exploitation requires only an untrusted Avro stream.

Database specific

{
    "url": "https://pkg.go.dev/vuln/GO-2026-5047",
    "review_status": "REVIEWED"
}

References

Credits

- Daniel Błażewicz
- Ivan Korotkov

Affected packages

Go / github.com/iskorotkov/avro/v2

Package

Name: github.com/iskorotkov/avro/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/iskorotkov/avro/v2

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.33.0

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/iskorotkov/avro/v2"
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-5047.json"

Go / github.com/hamba/avro/v2

Package

Name: github.com/hamba/avro/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/hamba/avro/v2

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/hamba/avro/v2"
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-5047.json"