CVE-2026-46384: CWE-190: Integer Overflow or Wraparound in iskorotkov avro
iskorotkov/avro is a fast Go Avro codec. Prior to 2.33.0, several Avro decoder paths read attacker-controlled 64-bit values from the wire format and either narrowed them to platform-sized int before bounds-checking, or summed them with overflow-prone signed-int arithmetic. On 32-bit targets (GOARCH=386, arm, mips, wasm, etc.), the truncation paths can silently bypass byte-slice limits, select the wrong union branch, or hit the OCF negative-make panic via wrap. Three sub-issues are not 32-bit-specific: cumulative-size arithmetic overflow in arrayDecoder.Decode / mapDecoder.Decode / mapDecoderUnmarshaler.Decode (wraps at math.MaxInt64 on amd64 / arm64 and bypasses MaxSliceAllocSize / MaxMapAllocSize), math.MinInt negation in block-header handling, and make([]byte, size) with a negative size in OCF block reads — all three panic or bypass caps on any platform, giving an attacker a denial-of-service primitive there. This vulnerability is fixed in 2.33.0.
AI Analysis
Technical Summary
The iskrotkov/avro library before version 2.33.0 has multiple integer overflow vulnerabilities in its Avro decoder implementation. Specifically, it narrows 64-bit attacker-controlled values to platform-sized integers before performing bounds checks, which is problematic especially on 32-bit architectures. Additionally, cumulative-size arithmetic overflows can bypass allocation size limits on all platforms. These flaws may lead to denial-of-service conditions caused by panics or memory allocation failures. The issues are resolved in version 2.33.0.
Potential Impact
Exploitation of these integer overflow vulnerabilities can cause denial-of-service conditions by triggering panics or memory allocation errors in applications using the affected Avro decoder versions. There is no indication of code execution or data corruption beyond denial-of-service.
Mitigation Recommendations
A fix is available in iskrotkov/avro version 2.33.0. Users should upgrade to version 2.33.0 or later to remediate these vulnerabilities. Patch status is confirmed by the vendor advisory. No additional mitigations are specified.
CVE-2026-46384: CWE-190: Integer Overflow or Wraparound in iskorotkov avro
Description
iskorotkov/avro is a fast Go Avro codec. Prior to 2.33.0, several Avro decoder paths read attacker-controlled 64-bit values from the wire format and either narrowed them to platform-sized int before bounds-checking, or summed them with overflow-prone signed-int arithmetic. On 32-bit targets (GOARCH=386, arm, mips, wasm, etc.), the truncation paths can silently bypass byte-slice limits, select the wrong union branch, or hit the OCF negative-make panic via wrap. Three sub-issues are not 32-bit-specific: cumulative-size arithmetic overflow in arrayDecoder.Decode / mapDecoder.Decode / mapDecoderUnmarshaler.Decode (wraps at math.MaxInt64 on amd64 / arm64 and bypasses MaxSliceAllocSize / MaxMapAllocSize), math.MinInt negation in block-header handling, and make([]byte, size) with a negative size in OCF block reads — all three panic or bypass caps on any platform, giving an attacker a denial-of-service primitive there. This vulnerability is fixed in 2.33.0.
CVSS v4.0
Score 8.7high
Affected software
pkg:golang/github.com/iskorotkov/avroRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The iskrotkov/avro library before version 2.33.0 has multiple integer overflow vulnerabilities in its Avro decoder implementation. Specifically, it narrows 64-bit attacker-controlled values to platform-sized integers before performing bounds checks, which is problematic especially on 32-bit architectures. Additionally, cumulative-size arithmetic overflows can bypass allocation size limits on all platforms. These flaws may lead to denial-of-service conditions caused by panics or memory allocation failures. The issues are resolved in version 2.33.0.
Potential Impact
Exploitation of these integer overflow vulnerabilities can cause denial-of-service conditions by triggering panics or memory allocation errors in applications using the affected Avro decoder versions. There is no indication of code execution or data corruption beyond denial-of-service.
Mitigation Recommendations
A fix is available in iskrotkov/avro version 2.33.0. Users should upgrade to version 2.33.0 or later to remediate these vulnerabilities. Patch status is confirmed by the vendor advisory. No additional mitigations are specified.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-13T19:53:47.922Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
- Gcve Source
- db.gcve.eu
Threat ID: 6a19feb4e29bf47b500fc2dd
Added to database: 05/29/2026, 21:01:40 UTC
Last enriched: 07/29/2026, 21:03:18 UTC
Last updated: 07/31/2026, 19:32:48 UTC
Views: 88
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.