Read the docs
TI-2026-34099 Aliases CVE-2026-46385GHSA-w8j3-pq8g-8m7w

iskorotkov/avro: CPU Exhaustion in Avro Decoder

Priority HIGH 77CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

iskorotkov/avro is a fast Go Avro codec. Prior to 2.33.0, the Avro array and map decoders looped over an attacker-controlled block-count value without checking the underlying reader's error state inside the loop body. Reader.ReadBlockHeader returns the count as a Go int, which is 64-bit on amd64 / arm64 targets — so a producer can declare a block of up to math.MaxInt64 (~9.2 × 10¹⁸) elements followed by EOF (or any truncated payload), and the decoder will attempt that many no-op iterations before propagating the error. The realistic ceiling is "indefinite until the worker is killed externally" — a single hostile payload pins a CPU core until the process is OOM-killed, deadline-cancelled, or terminated. Remote, unauthenticated denial-of-service. This vulnerability is fixed in 2.33.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00614 49th percentileScored 2026-11-07
Fix Fixed avro (iskorotkov): 2.33.0github.com/iskorotkov/avro/v2 (Go): 2.33.0Red Hat: 10 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
iskorotkovavrobefore 2.33.02.33.0Patch availableCNA
—github.com/iskorotkov/avro/v2 (Go)before 2.33.02.33.0Patch availableGHSA-w8j3-pq8g-8m7w
  • avro Vendoriskorotkov Affected before 2.33.0 Fixed in 2.33.0 Patch available CNA
  • github.com/iskorotkov/avro/v2 (Go) Vendor— Affected before 2.33.0 Fixed in 2.33.0 Patch available GHSA-w8j3-pq8g-8m7w

Remediation

  • Fix · CNA avro (iskorotkov) Fixed in 2.33.0
  • Fix · GHSA-w8j3-pq8g-8m7w github.com/iskorotkov/avro/v2 (Go) Fixed in 2.33.0 Advisory →

Red Hat 10 advisories

  • RHSA-2026:60386 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.17.1 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.17 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +31
  • RHSA-2026:57191 Released 2026-08-19 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.16.3 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.16 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9, registry.redhat.io/rhacm2/acm-prometheus-rhel9 +15
  • RHSA-2026:53530 Released 2026-08-11 · Red Hat rating Critical
    Multicluster Global Hub 1.7.2 security update
    • Multicluster Global Hub 1.7.4 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
Show 7 more Red Hat advisories
  • RHSA-2026:48151 Released 2026-07-29 · Red Hat rating Important
    Red Hat build of Cryostat security update
    • Cryostat 4 on RHEL 9 cryostat/cryostat-grafana-dashboard-rhel9, cryostat/cryostat-openshift-console-plugin-rhel9, cryostat/cryostat-reports-rhel9 +4
  • RHSA-2026:47149 Released 2026-07-28 · Red Hat rating Important
    Multicluster Global Hub 1.7.2 security update
    • Multicluster Global Hub 1.7.4 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
  • RHSA-2026:44622 Released 2026-07-23 · Red Hat rating Important
    Multicluster Global Hub 1.6.4 security update
    • Multicluster Global Hub 1.6.6 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
  • RHSA-2026:42852 Released 2026-07-21 · Red Hat rating Important
    Multicluster Global Hub 1.5.6 security update
    • Multicluster Global Hub 1.5.8 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
  • RHSA-2026:41064 Released 2026-07-16 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.11.10 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.11 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/console-rhel9, registry.redhat.io/rhacm2/multicluster-operators-subscription-rhel9
  • RHSA-2026:41030 Released 2026-07-16 · Red Hat rating Important
    Multicluster Global Hub 1.4.7 security update
    • Multicluster Global Hub 1.4.9 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
  • RHSA-2026:30651 Released 2026-06-28 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.13.9 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +18

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Cryostat 4 on RHEL 9Fixed RHSA-2026:48151
Multicluster Global Hub 1.4.9Fixed RHSA-2026:41030
Multicluster Global Hub 1.5.8Fixed RHSA-2026:42852
Multicluster Global Hub 1.6.6Fixed RHSA-2026:44622
Multicluster Global Hub 1.7.4Fixed RHSA-2026:47149, RHSA-2026:53530
Red Hat Advanced Cluster Management for Kubernetes 2.11Fixed RHSA-2026:41064
Red Hat Advanced Cluster Management for Kubernetes 2.13Fixed RHSA-2026:30651
Red Hat Advanced Cluster Management for Kubernetes 2.16Fixed RHSA-2026:57191
Red Hat Advanced Cluster Management for Kubernetes 2.17Fixed RHSA-2026:60386
Not affected: 13 products
  • Cryostat 4 on RHEL 9
  • Multicluster Global Hub 1.4.9
  • Multicluster Global Hub 1.5.8
  • Multicluster Global Hub 1.6.6
  • Multicluster Global Hub 1.7.4
  • Red Hat Advanced Cluster Management for Kubernetes 2.11
  • Red Hat Advanced Cluster Management for Kubernetes 2.13
  • Red Hat Advanced Cluster Management for Kubernetes 2.16
  • Red Hat Advanced Cluster Management for Kubernetes 2.17
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Hardened Images

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-46385
  2. 2026-10-03 Alias added: GHSA-w8j3-pq8g-8m7w
  3. 2026-10-25 EPSS moved to the below the 50th percentile
  4. 2026-11-06 Fix available: Multicluster Global Hub 1.7.4 · Red Hat

References

Advisory 1

Other 2

  • TI-2026-34098 iskorotkov/avro: Integer Overflow in Avro Decoder CVSS 4.0HIGH 8.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences