avro vulnerabilities

2 known vulnerabilities in avro from Iskorotkov. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  avro: Uncontrolled Resource Consumption

  CVE-2026-46385May 29, 2026Iskorotkov

  iskorotkov/avro is a fast Go Avro codec. Prior to 2.33.0, the Avro array and map decoders looped over an attacker-controlled block-count value without checking the underlying reader's error state inside the loop body. Reader.ReadBlockHeader returns the count a

• 7.5 High severity

  avro: Integer Overflow or Wraparound

  CVE-2026-46384May 29, 2026Iskorotkov

  iskorotkov/avro is a fast Go Avro codec. Prior to 2.33.0, several Avro decoder paths read attacker-controlled 64-bit values from the wire format and either narrowed them to platform-sized int before bounds-checking, or summed them with overflow-prone signed-in