{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"github.com/hamba/avro/v2","cve_ids":["CVE-2026-46384"],"ecosystem":"Go","epss":0.00549,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-mc57-h6j3-3hmv","id":"tcs_01M5KGHGCW05606W5FPG2NE20R","modified_at":"2026-08-05T03:41:56.388939483Z","published_at":"2026-07-27T16:16:22Z","references":["https://osv.dev/vulnerability/GO-2026-5047","https://github.com/iskorotkov/avro/security/advisories/GHSA-mc57-h6j3-3hmv","https://github.com/iskorotkov/avro/commit/bed99b315ec097a1a5eb7ae074ef57a91848c583","https://github.com/iskorotkov/avro/commit/e1a570f9a8a4fe4b1bc2b4b1fb6d24e4a5f04358"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2026-5047#Go/github.com/hamba/avro/v2","url":"https://osv.dev/vulnerability/GO-2026-5047"}],"summary":"Integer overflow in Avro decoder in github.com/iskorotkov/avro/v2 and github.com/hamba/avro/v2"}