{"id":"CVE-2026-46384","aliases":["GHSA-mc57-h6j3-3hmv","GO-2026-5047"],"url":"https://o3.security/vulnerability/CVE-2026-46384","summary":"iskorotkov/avro: Integer Overflow in Avro Decoder","details":"iskorotkov/avro is a fast Go Avro codec. Prior to 2.33.0, several Avro decoder paths read attacker-controlled 64-bit values from the wire format and either narrowed them to platform-sized int before bounds-checking, or summed them with overflow-prone signed-int arithmetic. On 32-bit targets (GOARCH=386, arm, mips, wasm, etc.), the truncation paths can silently bypass byte-slice limits, select the wrong union branch, or hit the OCF negative-make panic via wrap. Three sub-issues are not 32-bit-specific: cumulative-size arithmetic overflow in arrayDecoder.Decode / mapDecoder.Decode / mapDecoderUnmarshaler.Decode (wraps at math.MaxInt64 on amd64 / arm64 and bypasses MaxSliceAllocSize / MaxMapAllocSize), math.MinInt negation in block-header handling, and make([]byte, size) with a negative size in OCF block reads — all three panic or bypass caps on any platform, giving an attacker a denial-of-service primitive there. This vulnerability is fixed in 2.33.0.","published":"2026-05-29T19:58:21.535Z","modified":"2026-08-15T11:30:53.676809153Z","cvss":null,"epss":{"score":0.00529,"percentile":0.42282,"asOf":"2026-08-15"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/iskorotkov/avro/v2","fixedVersion":"2.33.0"}],"fix":null,"references":[{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46384.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:30651"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:41030"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:41064"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:42852"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:44622"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:47149"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:48151"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:53530"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-46384"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46384.json"},{"type":"ADVISORY","url":"https://github.com/iskorotkov/avro/security/advisories/GHSA-mc57-h6j3-3hmv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46384"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2483482"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-15T11:30:53.676809153Z"}}