CVE-2026-46385 iskorotkov CVE debrief

Who should care

Defenders responsible for Go environments, particularly those using the iskorotkov/avro library, should assess exposure and prioritize patching to prevent potential denial-of-service attacks. This includes reviewing the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Why it matters

CVE-2026-46385 is a high-severity vulnerability in the iskorotkov/avro fast Go Avro codec that allows for remote, unauthenticated denial-of-service attacks. Defenders should prioritize patching to version 2.33.0 or later, assess exposure in Go environments, and monitor for suspicious activity.

• Denial-of-service attacks can cause significant downtime and resource utilization
• Unauthenticated attacks can be launched remotely, increasing the attack surface
• Successful exploitation can lead to CPU core pinning until the process is terminated

Technical summary

The iskorotkov/avro fast Go Avro codec has a vulnerability in its Avro array and map decoders. Prior to version 2.33.0, the decoders loop over an attacker-controlled block-count value without checking the underlying reader's error state. This allows for remote, unauthenticated denial-of-service attacks. The issue can be mitigated by patching to version 2.33.0 or later and assessing exposure in Go environments. The vulnerability has a high severity score and can cause significant downtime and resource utilization. Defenders should prioritize patching and monitor for suspicious activity.

Defensive priority

Defenders should prioritize patching to version 2.33.0 or later, assess exposure in Go environments, and monitor for suspicious activity.

Recommended defensive actions

• Patch to version 2.33.0 or later
• Assess exposure in Go environments
• Monitor for suspicious activity
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• technicalSummary

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and affected versions. Red Hat errata provide additional information on affected products and patches. The vulnerability allows for remote, unauthenticated denial-of-service attacks due to improper handling of Avro array and map decoders in the iskorotkov/avro fast Go Avro codec. Defenders should verify affected scope, assess exposure, and prioritize patching to version 2.33.0 or later.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.