{"schema_version":"1.7.5","id":"GO-2026-5047","published":"2026-07-27T16:16:22Z","modified":"2026-08-05T03:41:56.388939483Z","aliases":["CVE-2026-46384","GHSA-mc57-h6j3-3hmv"],"related":["CGA-pmrq-j6rg-c6qp"],"summary":"Integer overflow in Avro decoder in github.com/iskorotkov/avro/v2 and github.com/hamba/avro/v2","details":"Several Avro decoder paths read attacker-controlled 64-bit values from the wire format and either narrowed them to platform-sized int before bounds-checking, or summed them with overflow-prone signed-int arithmetic. On 32-bit targets, the truncation paths can silently bypass byte-slice limits, select the wrong union branch, or hit a negative-make panic via wrap.\n\nThree sub-issues are not 32-bit-specific: cumulative-size arithmetic overflow in array and map decoders, negation of MinInt in block-header handling, and negative size in block reads. All three panic or bypass caps on any platform, giving an attacker a denial-of-service primitive. Exploitation requires only an untrusted Avro stream.","affected":[{"package":{"name":"github.com/iskorotkov/avro/v2","ecosystem":"Go","purl":"pkg:golang/github.com/iskorotkov/avro/v2"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.33.0"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/iskorotkov/avro/v2"}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-5047.json"}},{"package":{"name":"github.com/hamba/avro/v2","ecosystem":"Go","purl":"pkg:golang/github.com/hamba/avro/v2"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/hamba/avro/v2"}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-5047.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/iskorotkov/avro/security/advisories/GHSA-mc57-h6j3-3hmv"},{"type":"FIX","url":"https://github.com/iskorotkov/avro/commit/bed99b315ec097a1a5eb7ae074ef57a91848c583"},{"type":"FIX","url":"https://github.com/iskorotkov/avro/commit/e1a570f9a8a4fe4b1bc2b4b1fb6d24e4a5f04358"}],"database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-5047"},"credits":[{"name":"Daniel Błażewicz"},{"name":"Ivan Korotkov"}]}