CVE-2026-46385: iskorotkov/avro Go DoS Vulnerability

CVE-2026-46385 Overview

CVE-2026-46385 is a denial-of-service vulnerability in iskorotkov/avro, a fast Go Avro codec. Versions prior to 2.33.0 fail to validate the block-count value when decoding Avro arrays and maps. An attacker can supply a crafted payload that declares up to math.MaxInt64 elements followed by a truncated stream. The decoder enters a tight loop and ignores the underlying reader's error state, pinning a CPU core until the process is killed externally. The flaw is classified under CWE-400: Uncontrolled Resource Consumption and is remotely exploitable without authentication.

Critical Impact
A single hostile Avro payload causes indefinite CPU exhaustion on the decoding worker, resulting in remote, unauthenticated denial of service against any service that parses untrusted Avro data.

Affected Products

iskorotkov/avro Go module versions prior to 2.33.0
Go services on amd64 or arm64 targets where int is 64-bit
Any application decoding untrusted Avro arrays or maps with the affected library

Discovery Timeline

2026-05-29 - CVE-2026-46385 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-46385

Vulnerability Analysis

The vulnerability resides in the Avro array and map decoders within iskorotkov/avro. Avro encodes arrays and maps as a sequence of blocks, each prefixed with an element count read by Reader.ReadBlockHeader. The decoder loops over this attacker-controlled count to read individual elements.

The loop body does not check the reader's error state between iterations. When the producer declares a very large count followed by an EOF or truncated payload, the inner read operations return errors but the outer loop continues iterating. Only after the loop completes does the decoder propagate the error to the caller.

Root Cause

Reader.ReadBlockHeader returns the block count as a Go int. On amd64 and arm64 platforms this is a 64-bit signed integer with a maximum value of approximately 9.2 × 10¹⁸. The decoder treats this attacker-supplied count as authoritative and uses it as the upper bound of a for loop. Without an intra-loop check on reader errors or a sanity cap on block sizes, the iteration count is effectively unbounded.

Attack Vector

An unauthenticated remote attacker submits an Avro-encoded message to any endpoint that deserializes Avro arrays or maps using the vulnerable library. The payload encodes a block header claiming math.MaxInt64 entries, followed by no further data or a truncated stream. The decoder enters the no-op iteration loop and consumes 100% of a CPU core. The realistic ceiling is indefinite execution until the worker is OOM-killed, deadline-cancelled, or terminated externally.

No authentication, user interaction, or special privileges are required. Services that accept Avro messages over HTTP, message queues, gRPC, or stream-processing pipelines are exposed when handling untrusted producers.

Detection Methods for CVE-2026-46385

Indicators of Compromise

Sustained 100% CPU utilization on a single goroutine or worker process handling Avro payloads
Avro decoding operations exceeding configured request deadlines or context timeouts
Process-level OOM kills or watchdog terminations of services parsing external Avro input
Inbound Avro messages with abnormally large declared block counts in array or map headers

Detection Strategies

Audit Go module dependencies for iskorotkov/avro versions earlier than 2.33.0 using go list -m all
Profile services with pprof to identify goroutines stuck in Avro decoder loops
Inspect Avro payloads at the ingress boundary and reject messages where block-count headers exceed a reasonable threshold
Correlate spikes in request latency or worker restarts with the arrival of Avro messages from untrusted sources

Monitoring Recommendations

Alert on per-request CPU time consumed by Avro decoding workers exceeding baseline thresholds
Track decode duration percentiles for Avro endpoints and trigger on outliers
Monitor process restart counts and OOM-kill events on services that consume Avro streams
Log and review block-count distributions reported by upstream proxies or schema validators

How to Mitigate CVE-2026-46385

Immediate Actions Required

Upgrade iskorotkov/avro to version 2.33.0 or later in all Go modules that depend on it
Inventory services that decode untrusted Avro input and prioritize them for patching
Apply request-level CPU and deadline limits to Avro-decoding endpoints to bound damage from unpatched workers
Restrict Avro producers to authenticated and trusted sources where business logic permits

Patch Information

The maintainer fixed the issue in version 2.33.0 by validating the reader's error state during block iteration. See the GitHub Security Advisory GHSA-w8j3-pq8g-8m7w for the upstream fix and advisory text. Update the dependency with go get github.com/iskorotkov/avro@v2.33.0 and rebuild affected services.

Workarounds

Enforce strict context.WithTimeout deadlines on every Avro decode operation to bound worst-case CPU consumption
Place a schema-aware proxy or validator in front of decoders to reject messages with implausible block counts
Limit the maximum size of inbound Avro payloads at the network or application layer
Run Avro-decoding workers in isolated processes with cgroup CPU quotas so a single hostile payload cannot starve other workloads

bash

# Configuration example
go get github.com/iskorotkov/avro@v2.33.0
go mod tidy
go build ./...