{"action":"Upgrade github.com/iskorotkov/avro/v2 to 2.33.0 or later.","affected":[{"fixed":"2.33.0","introduced":"0"}],"component":"github.com/iskorotkov/avro/v2","cve_ids":["CVE-2026-46385"],"ecosystem":"Go","epss":0.00614,"exploited":false,"fixed_versions":["2.33.0"],"ghsa_id":"GHSA-w8j3-pq8g-8m7w","id":"tcs_01M5KGHFN151VEWB2D8NK0YHAN","modified_at":"2026-08-05T03:41:56.678986925Z","published_at":"2026-07-27T16:16:22Z","references":["https://osv.dev/vulnerability/GO-2026-5046","https://github.com/iskorotkov/avro/security/advisories/GHSA-w8j3-pq8g-8m7w","https://github.com/iskorotkov/avro/commit/2ce4242e6095d93470ab3b37ed6082b0596f325c","https://github.com/iskorotkov/avro/commit/b124caa58a821f68f100d86f045f9753b88881e8"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2026-5046","url":"https://osv.dev/vulnerability/GO-2026-5046"}],"summary":"CPU exhaustion in Avro decoder in github.com/iskorotkov/avro/v2 and github.com/hamba/avro/v2"}