CVE-2026-46384 Overview
CVE-2026-46384 affects iskorotkov/avro, a Go Avro codec library. Multiple decoder paths read attacker-controlled 64-bit values from the Avro wire format and either narrow them to platform-sized int before bounds checking or perform overflow-prone signed arithmetic. An attacker who can submit crafted Avro payloads to a consuming service triggers integer overflow conditions that bypass allocation limits, induce panics, or cause incorrect union branch selection. The flaw is tracked as an integer overflow weakness [CWE-190]. The maintainer fixed the issue in version 2.33.0.
Critical Impact
Remote attackers can crash Go services parsing untrusted Avro data, producing a reliable denial-of-service primitive on any platform.
Affected Products
- iskorotkov/avro Go module versions prior to 2.33.0
- Applications consuming untrusted Avro payloads on 32-bit targets (GOARCH=386, arm, mips, wasm)
- Applications consuming untrusted Avro payloads on 64-bit targets (amd64, arm64) — subset of issues
Discovery Timeline
- 2026-05-29 - CVE-2026-46384 published to NVD
- 2026-05-29 - Last updated in NVD database
Technical Details for CVE-2026-46384
Vulnerability Analysis
The vulnerability spans several Avro decoder paths in the iskorotkov/avro library. Avro encodes length and size fields as 64-bit zig-zag varints. The decoder reads these values as int64 then narrows them to int before validating bounds. On 32-bit architectures, the narrowing truncates the upper bits, allowing values that exceed MaxSliceAllocSize to pass length checks. Truncation also affects union branch selection, where an attacker can steer decoding to an unintended schema branch.
Three additional sub-issues affect all platforms regardless of word size. Cumulative-size arithmetic in arrayDecoder.Decode, mapDecoder.Decode, and mapDecoderUnmarshaler.Decode wraps at math.MaxInt64, bypassing the MaxSliceAllocSize and MaxMapAllocSize caps. Block-header handling negates a signed integer that may equal math.MinInt, producing undefined wrap behavior. Object Container File (OCF) block reads invoke make([]byte, size) with a value that can be negative, triggering a runtime panic.
Root Cause
The root cause is unchecked narrowing of int64 wire values to platform int combined with signed arithmetic that lacks overflow guards. Length and size fields are trusted across arithmetic operations before final allocation checks execute.
Attack Vector
An unauthenticated attacker delivers a crafted Avro payload to any endpoint that decodes Avro using a vulnerable version. The payload contains oversized length prefixes or cumulative sizes engineered to overflow signed-integer arithmetic. The decoder either panics, allocates undersized buffers, or selects the wrong union branch during parsing.
No verified public proof-of-concept code accompanies the advisory. See the GitHub Security Advisory GHSA-mc57-h6j3-3hmv for the affected source paths.
Detection Methods for CVE-2026-46384
Indicators of Compromise
- Unexpected Go runtime panics with stack traces referencing arrayDecoder.Decode, mapDecoder.Decode, or OCF block-read functions.
- Process crashes correlated with inbound Avro payloads from untrusted producers.
- Repeated service restarts triggered by malformed Avro messages on Kafka, NATS, or HTTP ingestion paths.
Detection Strategies
- Inventory Go services and identify dependencies on github.com/iskorotkov/avro at versions earlier than 2.33.0 using go list -m all or SBOM tooling.
- Monitor application logs for runtime error: makeslice: len out of range and panic signatures originating from Avro decoder frames.
- Inspect Avro payloads at ingress for length prefixes that exceed configured maximum sizes.
Monitoring Recommendations
- Track crash rates and restart counts for Avro-consuming microservices and alert on anomalies.
- Forward Go panic stack traces to a centralized log platform and create rules matching the affected decoder symbols.
- Audit upstream message producers to confirm schema compliance and message-size limits.
How to Mitigate CVE-2026-46384
Immediate Actions Required
- Upgrade github.com/iskorotkov/avro to version 2.33.0 or later across all Go services.
- Rebuild and redeploy all binaries that statically link the affected library.
- Re-run dependency scans and SBOM checks to confirm no transitive references to vulnerable versions remain.
Patch Information
The maintainer released the fix in version 2.33.0. Update go.mod with go get github.com/iskorotkov/avro@v2.33.0 and run go mod tidy. Review the GitHub Security Advisory for the complete list of corrected decoder paths.
Workarounds
- Enforce strict maximum message-size limits at the transport layer ahead of Avro decoding.
- Validate Avro schemas against an allowlist and reject payloads from untrusted producers.
- Run Avro-consuming services with process supervisors that contain panic blast radius and rate-limit restarts.
# Update to the patched release
go get github.com/iskorotkov/avro@v2.33.0
go mod tidy
go build ./...
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
