---
id: CVE-2022-36124
title: >-
  It is possible for a Reader to consume memory beyond the allowed constraints
  and thus lead to out of memory on the system
summary: >-
  It is possible for a Reader to consume memory beyond the allowed constraints
  and thus lead to out of memory on the system. This issue affects Rust
  applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as
  avro-rs). Use…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-770
  - CWE-770
vendor: apache
product: avro
affected:
  - avro < 0.14.0
patched:
  - avro 0.14.0
published: '2022-08-09'
updated: '2026-06-23'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2022-36124'
references:
  - url: 'https://lists.apache.org/thread/kj429rzo1xxjgz058qqqg0y7c0p512zo'
    label: security@apache.org
  - url: 'https://lists.apache.org/thread/kj429rzo1xxjgz058qqqg0y7c0p512zo'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.01436
epssPercentile: 0.71995
ingestedAt: '2026-06-29T13:24:33.497Z'
---

## Overview

It is possible for a Reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to apache-avro version 0.14.0 which addresses this issue.

## Affected

- `avro < 0.14.0`

## Remediation

Upgrade past the affected range:

- `avro 0.14.0`