CVE-2026-46385: iskorotkov/avro Denial-of-Service via Unbounded Block Iteration

Technical summary

The Avro array and map decoders in iskorotkov/avro prior to version 2.33.0 contain a resource exhaustion vulnerability (CWE-835: Infinite Loop). The Reader.ReadBlockHeader function returns a block count as a Go int (64-bit on amd64/arm64 platforms), which the decoders loop over without validating the underlying reader's error state on each iteration. An attacker can send a payload declaring a block count approaching math.MaxInt64 (~9.2 × 10^18) followed by EOF or truncated data. The decoder will attempt all declared iterations before propagating the error, effectively performing busy-waiting on that value rather than failing fast. This creates a denial-of-service condition where a single message pins a CPU core until external termination, out-of-memory condition, or deadline expiration.

Business impact

Applications using iskorotkov/avro for message processing face availability risk. A remote attacker can disable service endpoints by submitting crafted Avro payloads, causing worker threads or goroutines to exhaust CPU and memory until the process crashes or becomes unresponsive. This is particularly damaging in microservices architectures, API gateways, or data pipelines where Avro is used for deserialization. Recovery requires manual intervention (process restart or kill), and the attack surface includes any network-accessible service that accepts Avro-encoded input.

Affected systems

All applications and services using iskorotkov/avro library versions prior to 2.33.0 are affected. This includes any Go-based service that deserializes untrusted Avro messages—for example, Kafka consumers, REST API backends, message queue processors, or data analytics pipelines. The vulnerability is platform-independent but has the most severe impact on 64-bit architectures (amd64, arm64) where the block count can reach maximum int values; 32-bit builds would have smaller upper bounds but remain vulnerable to resource exhaustion.

Exploitability

Exploitability is high. No authentication, special network conditions, or user interaction is required. An attacker needs only to craft a single Avro message with a large block count and send it to a vulnerable endpoint. The payload is trivial to construct—a standard Avro encoder can generate the malicious message, or it can be hand-crafted given knowledge of the Avro binary format. The barrier to exploitation is low; impact is immediate and deterministic.

Remediation

Upgrade iskorotkov/avro to version 2.33.0 or later, which includes fixes to validate the reader's error state during block decoding iterations. Teams should audit their dependencies to identify all services using this library and prioritize patching based on exposure (whether the service processes untrusted Avro input). Consider network-level mitigations such as request timeouts, resource limits per connection, and monitoring for unusual CPU spikes or goroutine proliferation during the patch window.

Patch guidance

Apply the fix by updating the library dependency to 2.33.0 or newer. For Go module-based projects, run 'go get -u iskorotkov/avro' or update the go.mod file directly and run 'go mod tidy'. Verify the upgrade by checking 'go list -m iskorotkov/avro' to confirm the installed version. Perform a staged rollout to production—start with non-critical or canary environments to ensure compatibility, then proceed to critical workloads. Given the simplicity of the exploit, expedited patching is recommended.

Detection guidance

Monitor for signs of resource exhaustion triggered by Avro decoding: sustained high CPU usage on a single core, rapid goroutine accumulation, or memory growth correlated with message ingestion. Log decoder errors and timeouts; a spike in these events may indicate exploitation attempts. Network-based detection is challenging but can be enhanced by inspecting Avro messages for unusually large block count declarations (larger than typical business payloads) or truncated payloads. Implement rate limiting and per-client resource quotas to limit damage from a single hostile payload.

Why prioritize this

This vulnerability scores 7.5 (HIGH) due to its remote, unauthenticated attack vector, low complexity, and high availability impact. Although it does not compromise confidentiality or integrity, the ability to crash services with a single network request makes it a priority for services processing untrusted Avro data. The vulnerability is not yet listed in the CISA KEV catalog, but the low barrier to exploitation and potential for widespread impact in data-driven architectures warrant rapid patching.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects: (1) Network Attack Vector—the vulnerability is remotely exploitable with no special network setup; (2) Low Attack Complexity—no special conditions or race conditions needed; (3) No Privileges or User Interaction required; (4) Unchanged Scope; (5) High impact to Availability—services become unavailable due to resource exhaustion. Confidentiality and Integrity are not affected (both None), hence the score reflects denial-of-service severity alone.

Frequently asked questions