Executive brief
A vulnerability in the Avro data processing library allows an attacker to crash a service by sending a specially crafted message. The library fails to limit how much memory it allocates when reading certain data structures (maps), allowing a malicious sender to exhaust all available system memory. This can lead to a complete service outage or system instability.
Technical details
The Avro map decoder in `codec_map.go` (specifically `mapDecoder.Decode` and `mapDecoderUnmarshaler.Decode`) fails to enforce an upper bound on attacker-controlled block-element counts. An attacker can provide a large element count in a single block or across multiple chunked blocks, causing the decoder to pre-allocate or grow a map until the process exhausts available memory (OOM). The vulnerability is present in the archived `hamba/avro` and its fork `iskorotkov/avro`. The fix in `iskorotkov/avro` v2.33.0 introduces `Config.MaxMapAllocSize` to track cumulative entry counts, but this protection is opt-in and must be explicitly configured to a non-zero value to mitigate the risk.
Affected products
- hamba avro/v2 <= v2.31.0
- iskorotkov avro/v2 < v2.33.0
Timeline
- 2026-04-30: patched: Fix introduced in PR #5
- 2026-05-06: advisory: v2.33.0 released
- 2026-05-07: disclosed: Initial advisory publication