# CVE-2022-36124: Apache Avro Rust SDK resource exhaustion in Reader

Source: https://junglewise.ai/threats/cve-2022-36124-apache-avro-rust-sdk-resource-exhaustion-in-reader  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-08-10. Updated: 2026-05-19  
License: CC BY 4.0 with a link back

CVE-2022-36124 · Severity: high · CVSS 7.5 · Published 2022-08-10

The Apache Avro Rust SDK, a library used for data serialization and exchange, contains a vulnerability that allows it to consume excessive system memory. An attacker could exploit this to crash applications or services using the library, leading to a denial of service. This could disrupt business operations and impact the availability of systems processing Avro data.

Technologies: [apache-avro (crates.io)](https://junglewise.ai/threats/technologies/apache-avro), [avro (PyPI)](https://junglewise.ai/threats/technologies/pypi-avro). Vendors: [Apache Software Foundation](https://junglewise.ai/threats/vendors/apache-software-foundation), [crates.io](https://junglewise.ai/threats/vendors/crates-io), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2022-36124 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-36124 being exploited in the wild.

**How severe is CVE-2022-36124?** High severity, with a CVSS score of 7.5, published 10 August 2022.

**Which products and versions are affected?** Apache Software Foundation Avro < 0.14.0; apache-avro (crates.io) < 0.14.0, SEMVER:introduced=0,fixed=0.14.0.

**Is there a fix for CVE-2022-36124?** Yes. apache-avro (crates.io): upgrade to 0.14.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-36124 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2022-36124?** Check whether you run Apache Software Foundation Avro, apache-avro (crates.io) or avro (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- apache-avro (crates.io): upgrade to 0.14.0 or later

  ```sh
  cargo update -p apache-avro
  ```


## Technical details

A resource exhaustion vulnerability (CWE-770) exists in the Apache Avro Rust SDK (formerly avro-rs) prior to version 0.14.0. The 'Reader' component fails to properly throttle or limit memory allocation when processing incoming data. A remote, unauthenticated attacker can provide specially crafted Avro data that triggers excessive memory consumption, leading to an Out-of-Memory (OOM) state and a denial-of-service (DoS) condition. The vulnerability is reachable over the network without user interaction. Users are advised to upgrade to apache-avro version 0.14.0.

## Affected products

- Apache apache-avro < 0.14.0

## Identifiers

- CVE-2022-36124
- GHSA-wcm8-86x6-8mv3
- PYSEC-2022-43180

## Timeline

- 2022-08-09: disclosed: NVD publication date
- 2022-08-10: advisory: GitHub Advisory published

## References

- [https://lists.apache.org/thread/kj429rzo1xxjgz058qqqg0y7c0p512zo](https://lists.apache.org/thread/kj429rzo1xxjgz058qqqg0y7c0p512zo)
- [https://github.com/pypa/advisory-database/tree/main/vulns/avro/PYSEC-2022-43180.yaml](https://github.com/pypa/advisory-database/tree/main/vulns/avro/PYSEC-2022-43180.yaml)

## Related threats

- [Apache Avro Java SDK code injection in avro-compiler](https://junglewise.ai/threats/cve-2025-33042-apache-avro-java-sdk-code-injection-in-avro-compiler)
- [Apache Avro Java SDK vulnerable to Improper Input Validation](https://junglewise.ai/threats/cve-2023-39410-pysec-2023-188-when-deserializing-untrusted-or-corrupted-data-it)
- [Apache Avro Rust SDK vulnerable to reader looping in cycle endlessly, consuming CPU](https://junglewise.ai/threats/cve-2022-35724-apache-avro-rust-sdk-vulnerable-to-reader-looping-in-cycle)
- [Apache Avro Rust SDK corrupted data read can cause crash](https://junglewise.ai/threats/cve-2022-36125-apache-avro-rust-sdk-corrupted-data-read-can-cause-crash)