CVE-2026-46385: iskorotkov/avro: CPU Exhaustion in Avro Decoder

Synopsis

This is a CPU-exhaustion denial-of-service in the iskorotkov/avro Go Avro codec. The array and map decoders trust an attacker-controlled 64-bit block count from the wire and loop on it without checking the reader's error state, so a single crafted payload declaring up to ~9.2 x 10^18 elements followed by EOF pins a worker CPU until the process is killed externally. The bug is reachable over the network without authentication and without any user interaction, and successful exploitation makes the decoding service unavailable. A patched-image rebuild at iskorotkov/avro 2.33.0 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to deliver an Avro payload to the decoder over the network (AV:N).

• AuthenticationNot required

  PR:N: no credentials or account are needed to send the malicious payload.

• Victim interactionNot required

  UI:N: the decoder processes the hostile payload on its own with no user action required.

• Attack complexityDetail

  AC:L: the exploit is a single crafted block header and triggers reliably without timing or memory-layout conditions.

Blast Radius

• Pins a CPU core on the decoding worker indefinitely until the process is OOM-killed, deadline-cancelled, or terminated.
• Renders the affected service unavailable for legitimate Avro traffic for the duration of the stuck worker.
• Amplifies trivially: a single small payload consumes a full core, so a handful of requests can exhaust a pool and take the service offline.
• No confidentiality or integrity impact: data is not read or modified, only availability is affected.