CVE-2026-46384 iskorotkov/avro: Integer Overflow in Avro Decoder
An integer overflow in the Avro decoder allows attackers to cause denial of service via crafted wire data, affecting Go applications using this library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-46384?
CVE-2026-46384 is a high-severity vulnerability in iskorotkov avro, published on 29 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
iskorotkov/avro is a fast Go Avro codec. Prior to 2.33.0, several Avro decoder paths read attacker-controlled 64-bit values from the wire format and either narrowed them to platform-sized int before bounds-checking, or summed them with overflow-prone signed-int arithmetic. On 32-bit targets (GOARCH=386, arm, mips, wasm, etc.), the truncation paths can silently bypass byte-slice limits, select the wrong union branch, or hit the OCF negative-make panic via wrap. Three sub-issues are not 32-bit-specific: cumulative-size arithmetic overflow in arrayDecoder.Decode / mapDecoder.Decode / mapDecoderUnmarshaler.Decode (wraps at math.MaxInt64 on amd64 / arm64 and bypasses MaxSliceAllocSize / MaxMapAllocSize), math.MinInt negation in block-header handling, and make([]byte, size) with a negative size in OCF block reads — all three panic or bypass caps on any platform, giving an attacker a denial-of-service primitive there. This vulnerability is fixed in 2.33.0.
Weakness: CWE-190
Which versions are affected by CVE-2026-46384?
4 open source packages ship an affected version, including github.com/iskorotkov/avro/v2 and github.com/hamba/avro/v2.
| Package | Affected | Fixed in |
|---|---|---|
github.com/iskorotkov/avro/v2 Go | All versions | 2.33.0 |
github.com/iskorotkov/avro/v2 Go | All versions | 2.33.0 |
github.com/iskorotkov/avro/v2 Go | All versions | 2.33.0 |
github.com/hamba/avro/v2 Go | All versions | None |
How do I fix CVE-2026-46384?
Upgrade github.com/iskorotkov/avro/v2 to 2.33.0 or later.
Is CVE-2026-46384 being exploited?
There is no known exploitation of CVE-2026-46384 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-OC65690, CLEANSTART-2026-TF86482, GHSA-mc57-h6j3-3hmv, GO-2026-5047, MINI-2x53-3q4m-x99j, MINI-3229-xjxx-pp3w and 14 more.