CVE-2026-46385

Go/github.com/iskorotkov/avro/v2 CVE-2026-46385: high 7.5

iskorotkov/avro: CPU Exhaustion in Decoder

Action: Upgrade github.com/iskorotkov/avro/v2 to 2.33.0 or later.

go get github.com/iskorotkov/avro/v2@v2.33.0

Affected

Fixed versions

Sources

• osv: GHSA-w8j3-pq8g-8m7w
• https://github.com/iskorotkov/avro/security/advisories/GHSA-w8j3-pq8g-8m7w
• https://nvd.nist.gov/vuln/detail/CVE-2026-46385
• https://github.com/iskorotkov/avro

CVE-2026-46385 · published 2026-05-18T16:33:43Z · modified 2026-09-10T03:50:47.881718268Z · JSON

Go/github.com/iskorotkov/avro/v2 CVE-2026-46385: unknown

CPU exhaustion in Avro decoder in github.com/iskorotkov/avro/v2 and github.com/hamba/avro/v2

Action: Upgrade github.com/iskorotkov/avro/v2 to 2.33.0 or later.

go get github.com/iskorotkov/avro/v2@v2.33.0

Affected

Fixed versions

Sources

• osv: GO-2026-5046
• https://github.com/iskorotkov/avro/security/advisories/GHSA-w8j3-pq8g-8m7w
• https://github.com/iskorotkov/avro/commit/2ce4242e6095d93470ab3b37ed6082b0596f325c
• https://github.com/iskorotkov/avro/commit/b124caa58a821f68f100d86f045f9753b88881e8

CVE-2026-46385 · published 2026-07-27T16:16:22Z · modified 2026-08-05T03:41:56.678986925Z · JSON

Go/github.com/hamba/avro/v2 CVE-2026-46385: unknown

CPU exhaustion in Avro decoder in github.com/iskorotkov/avro/v2 and github.com/hamba/avro/v2

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GO-2026-5046#Go/github.com/hamba/avro/v2
• https://github.com/iskorotkov/avro/security/advisories/GHSA-w8j3-pq8g-8m7w
• https://github.com/iskorotkov/avro/commit/2ce4242e6095d93470ab3b37ed6082b0596f325c
• https://github.com/iskorotkov/avro/commit/b124caa58a821f68f100d86f045f9753b88881e8

CVE-2026-46385 · published 2026-07-27T16:16:22Z · modified 2026-08-05T03:41:56.678986925Z · JSON