{"id":"CVE-2026-46385","title":"iskorotkov/avro is a fast Go Avro codec","summary":"iskorotkov/avro is a fast Go Avro codec. Prior to 2.33.0, the Avro array and map decoders looped over an attacker-controlled block-count value without checking the underlying reader's error state inside the loop body. Reader.ReadBlockHea…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-400","CWE-835"],"vendor":"iskorotkov","product":"avro","affected":["avro < 2.33.0"],"patched":["cryostat_4_on_rhel 9","multicluster_global_hub 1.4.5","multicluster_global_hub 1.6.5","multicluster_global_hub 1.7.0","advanced_cluster_management_for_kubernetes 2.11","advanced_cluster_management_for_kubernetes 2.13","advanced_cluster_management_for_kubernetes 2.16","advanced_cluster_management_for_kubernetes 2.17","multicluster_global_hub 1.5.3"],"published":"2026-05-29","updated":"2026-09-09","sourceUpdated":"2026-09-09T13:20:17.253","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-46385","references":[{"url":"https://github.com/iskorotkov/avro/security/advisories/GHSA-w8j3-pq8g-8m7w","label":"security-advisories@github.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:30651","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41030","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41064","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:42852","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:44622","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:47149","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:48151","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:53530","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:57191","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:60386","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-46385","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2483475","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://github.com/iskorotkov/avro/security/advisories/GHSA-w8j3-pq8g-8m7w","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46385.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-46385"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46385"}],"tags":["nvd","cve.org","exploit-available","csaf","vex","red-hat"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-06-01T16:22:43.598595Z"},"scores":{"nvd":7.5,"cna":8.7,"vendor":7.5},"epss":0.00622,"epssPercentile":0.48144,"ingestedAt":"2026-07-14T12:36:48.249Z","slug":"CVE-2026-46385","body":"## Overview\n\niskorotkov/avro is a fast Go Avro codec. Prior to 2.33.0, the Avro array and map decoders looped over an attacker-controlled block-count value without checking the underlying reader's error state inside the loop body. Reader.ReadBlockHeader returns the count as a Go int, which is 64-bit on amd64 / arm64 targets — so a producer can declare a block of up to math.MaxInt64 (~9.2 × 10¹⁸) elements followed by EOF (or any truncated payload), and the decoder will attempt that many no-op iterations before propagating the error. The realistic ceiling is \"indefinite until the worker is killed externally\" — a single hostile payload pins a CPU core until the process is OOM-killed, deadline-cancelled, or terminated. Remote, unauthenticated denial-of-service. This vulnerability is fixed in 2.33.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:48151** · Red Hat · fixed in: Cryostat 4 on RHEL 9 · released 2026-07-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:48151)\n- **RHSA-2026:41030** · Red Hat · fixed in: Multicluster Global Hub 1.4.5 · released 2026-07-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:41030)\n- **RHSA-2026:44622** · Red Hat · fixed in: Multicluster Global Hub 1.6.5 · released 2026-07-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:44622)\n- **RHSA-2026:47149** · Red Hat · fixed in: Multicluster Global Hub 1.7.0 · released 2026-07-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:47149)\n- **RHSA-2026:53530** · Red Hat · fixed in: Multicluster Global Hub 1.7.0 · released 2026-08-11 · [advisory](https://access.redhat.com/errata/RHSA-2026:53530)\n- **RHSA-2026:41064** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.11 · released 2026-07-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:41064)\n- **RHSA-2026:30651** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.13 · released 2026-06-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:30651)\n- **RHSA-2026:57191** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.16 · released 2026-08-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:57191)\n- **RHSA-2026:60386** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.17 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60386)\n- **RHSA-2026:42852** · Red Hat · fixed in: Red Hat multicluster global hub 1.5.3 · released 2026-07-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:42852)\n- **Red Hat VEX** · Important · affected: Red Hat Hardened Images · no fix planned: Red Hat Hardened Images · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46385.json)","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":201694,"id":"CVE-2026-46385","ts":1789399606855,"field":"exploit_available","old":"false","new":"true"},{"seq":200426,"id":"CVE-2026-46385","ts":1789397234756,"field":"exploit_available","old":"true","new":"false"},{"seq":198350,"id":"CVE-2026-46385","ts":1789391858717,"field":"exploit_available","old":"false","new":"true"},{"seq":196141,"id":"CVE-2026-46385","ts":1789383506897,"field":"exploit_available","old":"true","new":"false"},{"seq":195070,"id":"CVE-2026-46385","ts":1789380376018,"field":"exploit_available","old":"false","new":"true"},{"seq":193857,"id":"CVE-2026-46385","ts":1789378355383,"field":"exploit_available","old":"true","new":"false"},{"seq":192644,"id":"CVE-2026-46385","ts":1789376326178,"field":"exploit_available","old":"false","new":"true"},{"seq":191431,"id":"CVE-2026-46385","ts":1789373264449,"field":"exploit_available","old":"true","new":"false"},{"seq":190216,"id":"CVE-2026-46385","ts":1789369204590,"field":"exploit_available","old":"false","new":"true"},{"seq":189003,"id":"CVE-2026-46385","ts":1789368131630,"field":"exploit_available","old":"true","new":"false"},{"seq":187786,"id":"CVE-2026-46385","ts":1789365065688,"field":"exploit_available","old":"false","new":"true"},{"seq":186573,"id":"CVE-2026-46385","ts":1789363100595,"field":"exploit_available","old":"true","new":"false"},{"seq":185359,"id":"CVE-2026-46385","ts":1789361028403,"field":"exploit_available","old":"false","new":"true"},{"seq":184146,"id":"CVE-2026-46385","ts":1789358031944,"field":"exploit_available","old":"true","new":"false"},{"seq":182397,"id":"CVE-2026-46385","ts":1789354158108,"field":"exploit_available","old":"false","new":"true"},{"seq":181190,"id":"CVE-2026-46385","ts":1789353000639,"field":"exploit_available","old":"true","new":"false"},{"seq":179983,"id":"CVE-2026-46385","ts":1789350083381,"field":"exploit_available","old":"false","new":"true"},{"seq":178776,"id":"CVE-2026-46385","ts":1789347946128,"field":"exploit_available","old":"true","new":"false"},{"seq":177569,"id":"CVE-2026-46385","ts":1789346220838,"field":"exploit_available","old":"false","new":"true"},{"seq":176362,"id":"CVE-2026-46385","ts":1789342868039,"field":"exploit_available","old":"true","new":"false"},{"seq":175816,"id":"CVE-2026-46385","ts":1789338651645,"field":"exploit_available","old":"false","new":"true"},{"seq":175686,"id":"CVE-2026-46385","ts":1789338470711,"field":"exploit_available","old":"true","new":"false"},{"seq":174481,"id":"CVE-2026-46385","ts":1789334663825,"field":"exploit_available","old":"false","new":"true"},{"seq":173276,"id":"CVE-2026-46385","ts":1789333342578,"field":"exploit_available","old":"true","new":"false"},{"seq":172090,"id":"CVE-2026-46385","ts":1789330943896,"field":"exploit_available","old":"false","new":"true"},{"seq":170904,"id":"CVE-2026-46385","ts":1789328473737,"field":"exploit_available","old":"true","new":"false"},{"seq":169699,"id":"CVE-2026-46385","ts":1789326981540,"field":"exploit_available","old":"false","new":"true"},{"seq":168494,"id":"CVE-2026-46385","ts":1789323539006,"field":"exploit_available","old":"true","new":"false"},{"seq":167289,"id":"CVE-2026-46385","ts":1789319429952,"field":"exploit_available","old":"false","new":"true"},{"seq":166084,"id":"CVE-2026-46385","ts":1789318419102,"field":"exploit_available","old":"true","new":"false"},{"seq":164879,"id":"CVE-2026-46385","ts":1789315616979,"field":"exploit_available","old":"false","new":"true"},{"seq":163674,"id":"CVE-2026-46385","ts":1789313355797,"field":"exploit_available","old":"true","new":"false"},{"seq":162469,"id":"CVE-2026-46385","ts":1789311755804,"field":"exploit_available","old":"false","new":"true"},{"seq":161264,"id":"CVE-2026-46385","ts":1789308381241,"field":"exploit_available","old":"true","new":"false"},{"seq":160769,"id":"CVE-2026-46385","ts":1789304316346,"field":"exploit_available","old":"false","new":"true"},{"seq":160316,"id":"CVE-2026-46385","ts":1789303874232,"field":"exploit_available","old":"true","new":"false"},{"seq":159377,"id":"CVE-2026-46385","ts":1789300332978,"field":"exploit_available","old":"false","new":"true"},{"seq":158607,"id":"CVE-2026-46385","ts":1789299371930,"field":"exploit_available","old":"true","new":"false"},{"seq":157571,"id":"CVE-2026-46385","ts":1789296516905,"field":"exploit_available","old":"false","new":"true"},{"seq":156366,"id":"CVE-2026-46385","ts":1789294468458,"field":"exploit_available","old":"true","new":"false"},{"seq":155161,"id":"CVE-2026-46385","ts":1789292722142,"field":"exploit_available","old":"false","new":"true"},{"seq":153956,"id":"CVE-2026-46385","ts":1789289441584,"field":"exploit_available","old":"true","new":"false"},{"seq":152606,"id":"CVE-2026-46385","ts":1789281350920,"field":"exploit_available","old":"false","new":"true"},{"seq":152246,"id":"CVE-2026-46385","ts":1789280966852,"field":"exploit_available","old":"true","new":"false"},{"seq":151207,"id":"CVE-2026-46385","ts":1789277468257,"field":"exploit_available","old":"false","new":"true"},{"seq":150168,"id":"CVE-2026-46385","ts":1789275924700,"field":"exploit_available","old":"true","new":"false"},{"seq":149135,"id":"CVE-2026-46385","ts":1789273633855,"field":"exploit_available","old":"false","new":"true"},{"seq":148102,"id":"CVE-2026-46385","ts":1789270977691,"field":"exploit_available","old":"true","new":"false"},{"seq":146142,"id":"CVE-2026-46385","ts":1789269219854,"field":"exploit_available","old":"false","new":"true"},{"seq":145044,"id":"CVE-2026-46385","ts":1789266184737,"field":"exploit_available","old":"true","new":"false"}]}