The iskorotkov avro Go library versions before 2.33.0 contain a vulnerability where the Avro array and map decoders iterate over a block-count value provided by an attacker without verifying the reader's error state inside the loop. The reader returns the count as a 64-bit integer, allowing an attacker to specify an extremely large block count (up to math.MaxInt64) followed by truncated or invalid data. The decoder attempts to perform a very large number of no-op iterations before propagating the error, causing indefinite CPU consumption and effectively a remote denial-of-service condition. This issue is tracked as CWE-400 (Uncontrolled Resource Consumption) and CWE-835 (Loop with Unreachable Exit Condition). The vulnerability is fixed in version 2.33.0.

A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted Avro payloads with excessively large block-count values followed by truncated or invalid data. This causes the decoder to consume CPU resources indefinitely until the process is terminated or killed, resulting in denial of service. There is no impact on confidentiality or integrity, only availability is affected.

A fix for this vulnerability is available in iskorotkov avro version 2.33.0. Users are strongly advised to upgrade to version 2.33.0 or later to remediate this issue. Red Hat advises applying the relevant security updates when available. There are no known practical temporary workarounds that fully mitigate this issue.