Avro Decoder CPU Exhaustion DoS Vulnerability in iskorotkov/avro v2

Vulnerability Overview Vulnerability Name: CPU Exhaustion in Avro Decoder via Unbounded Block-Count Iteration Vulnerability Description: The Avro array and map decoders utilize attacker-controlled block count values in loops without checking the underlying reader's error state. This causes the decoder to attempt a large number of no-op iterations when encountering EOF (or a truncated payload), thereby consuming CPU resources. This vulnerability can be exploited to launch a Denial of Service (DoS) attack, causing processes to be killed by Out-of-Memory (OOM) killers, cancelled due to deadlines, or terminated. Affected Scope Affected Versions: <= v2.31.0 < v2.33.0 Affected Components: : and : and Remediation Fixed Versions: v2.33.0 and later Remediation Measures: Check the reader's accumulated error state after each internal call. Configure and to limit block counts. Migration Guide: Migrate from to v2.33.0 or higher. Update dependencies using . For consumers preferring the original import paths, use the directive in . Defensive Recommendations: For cases where immediate upgrades are not possible, limit cumulative allocations by setting and . Implement per-request decoding timeouts, isolate decoder workers, and reject payloads exceeding known security boundaries at the application level. Proof-of-Concept Input Explanation: The decoder reads the block count header, enters a loop, fails to read the first element (EOF), records the error, and then iterates times, invoking the internal decoder as a no-op each time. This results in an infinite loop until the process is killed by an OOM killer, cancelled due to a deadline, or terminated. References Fix PR: iskorotkov/avro#1 Fix Commits: b124caa, 2ce4242 Release Version: v2.33.0 Security Policy: SECURITY.md Related Vulnerability: GHSA-5c57-6j3j-3hw9 Cross-Module Precedent: hamba/avro Timeline 2026-04-28: Skip-decoder fix (b124caa) merged. 2026-04-30: Callback-decoder fix (PR #2, 2ce4242) merged. 2026-05-06: v2.33.0 tagged and released. 2026-05-11: Advisory published. 2026-05-15: Advisory revised.

Goal Reached Thanks to every supporter — we hit 100%!

Avro Decoder CPU Exhaustion DoS Vulnerability in iskorotkov/avro v2

More from this source