CVE-2026-46385

creationtimestamp| type| source ---|---|--- 2026-05-29 21:49:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmzjcgcjw427...

CVE-2026-46385 iskorotkov/avro: CPU Exhaustion in Avro Decoder

iskorotkov/avro is a fast Go Avro codec. Prior to 2.33.0, the Avro array and map decoders looped over an attacker-controlled block-count value without checking the underlying reader's error state inside the loop body. Reader.ReadBlockHeader returns the count as a Go int, which is 64-bit on amd64 ...