CVE-2026-46384 iskorotkov CVE debrief

Who should care

Go developers and administrators using the iskorotkov/avro fast Go Avro codec, especially those with 32-bit targets or systems exposed to potential denial-of-service attacks, should assess their exposure and prioritize remediation.

Why it matters

The CVE-2026-46384 vulnerability in the iskorotkov/avro fast Go Avro codec allows for denial-of-service attacks due to improper handling of 64-bit values. It affects 32-bit targets and can lead to silent bypass of byte-slice limits, incorrect union branch selection, or panics. The vulnerability is fixed in version 2.33.0.

• Denial-of-service attacks can be performed against vulnerable systems
• 32-bit targets are particularly affected by silent bypass of byte-slice limits
• Incorrect union branch selection can occur due to truncation of 64-bit values
• Cumulative-size arithmetic overflow can lead to panics or bypass of allocation limits

Technical summary

The iskorotkov/avro fast Go Avro codec, prior to version 2.33.0, has multiple issues with its Avro decoder paths. On 32-bit targets, truncation of 64-bit values can lead to silent bypass of byte-slice limits, incorrect union branch selection, or the OCF negative-make panic. Additionally, there are issues with cumulative-size arithmetic overflow in array and map decoders, math.MinInt negation in block-header handling, and negative size handling in OCF block reads. These issues can cause denial-of-service attacks on any platform.

Defensive priority

High

Recommended defensive actions

• Assess exposure of Go applications using iskorotkov/avro versions prior to 2.33.0
• Verify if 32-bit targets are in use and prioritize remediation for those systems
• Update to version 2.33.0 or later to fix the vulnerability
• Review and implement compensating controls for denial-of-service attacks
• Perform vulnerability scanning to identify potentially affected systems
• Review system logs for indicators of exploitation attempts
• Implement additional monitoring for systems with high risk exposure

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fixed version. Multiple Red Hat errata references are also provided, indicating affected and potentially fixed versions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.