The iskorotkov avro Go library versions prior to 2.33.0 contain multiple integer overflow and wraparound issues in their Avro decoding logic. These issues arise from unsafe narrowing of 64-bit attacker-controlled values to platform-sized integers before bounds checking, and overflow-prone signed integer arithmetic. On 32-bit architectures, this can bypass byte-slice limits, select incorrect union branches, or cause panics. Additional cross-platform issues include cumulative size arithmetic overflow in array and map decoders, negation of math.MinInt in block-header handling, and negative size allocations during OCF block reads. These flaws enable denial-of-service attacks by crashing the application or exhausting resources. The vulnerability is fixed in version 2.33.0.

A remote unauthenticated attacker can supply maliciously crafted Avro data to trigger integer overflows and unsafe memory allocations during decoding, resulting in denial of service through application crashes or excessive resource consumption. There is no impact on confidentiality or integrity, only availability is affected. The vulnerability affects both 32-bit and 64-bit platforms and can cause panics or bypass memory allocation limits.

An official fix is available in iskorotkov avro version 2.33.0. Users are strongly advised to upgrade to this version or later to remediate the vulnerability. No practical temporary workaround is known or recommended by the vendor. Applying the security update fully mitigates the issue.