{"id":"GO-2026-5048","aliases":["GHSA-mx64-mj3q-7prj"],"title":"Denial of service via unbounded map allocations in github.com/iskorotkov/avro/v2 and github.com/hamba/avro/v2","summary":"Denial of service via unbounded map allocations in github.com/iskorotkov/avro/v2 and github.com/hamba/avro/v2","severity":"none","vendor":"iskorotkov","product":"github.com/iskorotkov/avro/v2","ecosystem":"go","affected":["github.com/iskorotkov/avro/v2 < 2.33.0","github.com/hamba/avro/v2"],"patched":["github.com/iskorotkov/avro/v2 2.33.0"],"published":"2026-07-27","updated":"2026-07-27","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GO-2026-5048","references":[{"url":"https://github.com/iskorotkov/avro/security/advisories/GHSA-mx64-mj3q-7prj"},{"url":"https://github.com/iskorotkov/avro/commit/5192df96a158999344ac96ebcb1f7461d626f6d7"}],"tags":["osv","go"],"ingestedAt":"2026-07-27T19:08:55.723Z","slug":"GO-2026-5048","body":"## Overview\n\nThe Avro map decoder accepts attacker-controlled block-element counts from the wire format and grows the destination map without enforcing an upper bound. A producer can declare an arbitrarily large map (in one block, or chunked across many sub-limit blocks) and exhaust process memory until the OOM killer fires.\n\nThe fix introduces Config.MaxMapAllocSize with cumulative enforcement across block boundaries. The new limit is opt-in: the field defaults to zero, which preserves the previous unbounded behavior for backward compatibility. Upgrading to v2.33.0 alone does not mitigate the issue; consumers of untrusted Avro data must explicitly set MaxMapAllocSize on their avro.Config.\n\n## Affected packages\n\n- `github.com/iskorotkov/avro/v2 < 2.33.0`\n- `github.com/hamba/avro/v2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/iskorotkov/avro/v2 2.33.0`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}