# iskorotkov/avro memory exhaustion in map decoder

Source: https://junglewise.ai/threats/iskorotkov-avro-memory-exhaustion-in-map-decoder-7795edd3  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-18. Updated: 2026-05-18  
License: CC BY 4.0 with a link back

Severity: high · CVSS 7.5 · Published 2026-05-18

A vulnerability in the Avro data processing library allows an attacker to crash a service by sending a specially crafted message. The library fails to limit how much memory it allocates when reading certain data structures (maps), allowing a malicious sender to exhaust all available system memory. This can lead to a complete service outage or system instability.

Technologies: [github.com/iskorotkov/avro/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-iskorotkov-avro-v2), [Hamba Avro/V2](https://junglewise.ai/threats/technologies/avro-v2). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Hamba](https://junglewise.ai/threats/vendors/hamba).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** High severity, with a CVSS score of 7.5, published 18 May 2026.

**Which products and versions are affected?** github.com/iskorotkov/avro/v2 (Go) < 2.33.0; Hamba Avro/V2 <= v2.31.0.

**Is there a fix for This vulnerability?** A patch was published on 2026-04-30: Fix introduced in PR #5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run github.com/iskorotkov/avro/v2 (Go) or Hamba Avro/V2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Avro map decoder in `codec_map.go` (specifically `mapDecoder.Decode` and `mapDecoderUnmarshaler.Decode`) fails to enforce an upper bound on attacker-controlled block-element counts. An attacker can provide a large element count in a single block or across multiple chunked blocks, causing the decoder to pre-allocate or grow a map until the process exhausts available memory (OOM). The vulnerability is present in the archived `hamba/avro` and its fork `iskorotkov/avro`. The fix in `iskorotkov/avro` v2.33.0 introduces `Config.MaxMapAllocSize` to track cumulative entry counts, but this protection is opt-in and must be explicitly configured to a non-zero value to mitigate the risk.

## Affected products

- hamba avro/v2 <= v2.31.0
- iskorotkov avro/v2 < v2.33.0

## Timeline

- 2026-04-30: patched: Fix introduced in PR #5
- 2026-05-06: advisory: v2.33.0 released
- 2026-05-07: disclosed: Initial advisory publication

## References

- [https://api.github.com/users/klajok](https://api.github.com/users/klajok)
- [https://github.com/klajok](https://github.com/klajok)
- [https://api.github.com/users/klajok/gists%7B/gist_id%7D](https://api.github.com/users/klajok/gists%7B/gist_id%7D)
- [https://api.github.com/users/klajok/repos](https://api.github.com/users/klajok/repos)
- [https://avatars.githubusercontent.com/u/46300626?v=4](https://avatars.githubusercontent.com/u/46300626?v=4)
- [https://api.github.com/users/klajok/events%7B/privacy%7D](https://api.github.com/users/klajok/events%7B/privacy%7D)

## Related threats

- [GO-2026-5048 - Denial of service via unbounded map allocations in github.com/iskorotkov/avro/v2 and github.com/hamba/avro/v2](https://junglewise.ai/threats/go-2026-5048-denial-of-service-via-unbounded-map-allocations-in-github-046da6cd)
- [iskorotkov/avro CPU exhaustion in array and map decoders](https://junglewise.ai/threats/cve-2026-46385-iskorotkov-avro-cpu-exhaustion-in-array-and-map-decoders)
- [iskorotkov avro integer overflow and narrowing in decoder](https://junglewise.ai/threats/cve-2026-46384-iskorotkov-avro-integer-overflow-and-narrowing-in-decoder)