iskorotkov CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH iskorotkov CVE published 2026-05-29

CVE-2026-46385

CVE-2026-46385 is a high-severity vulnerability in the iskorotkov/avro fast Go Avro codec, allowing remote, unauthenticated denial-of-service attacks due to improper handling of Avro array and map decoders. The issue affects the iskorotkov/avro library, particularly in versions prior to 2.33.0. Defenders should prioritize patching to version 2.33.0 or later, assess exposure in Go environments, and monitor [truncated]

HIGH iskorotkov CVE published 2026-05-29

CVE-2026-46384

A vulnerability in the iskorotkov/avro fast Go Avro codec, prior to version 2.33.0, allows for denial-of-service attacks due to improper handling of 64-bit values from the wire format. This issue affects 32-bit targets and can lead to silent bypass of byte-slice limits, incorrect union branch selection, or panics. The vulnerability is fixed in version 2.33.0.