Homepage

Loop with Unreachable Exit Condition ('Infinite Loop') The advisory has been revoked - it doesn't affect any version of package grafana  (opens in a new tab)

Threat Intelligence

Social Trends
Trending on 𝕏
EPSS
0.5% (41st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-CENTOS9-GRAFANA-17345674
  • published16 Jun 2026
  • disclosed29 May 2026
Report a new vulnerability Found a mistake?

Introduced: 29 May 2026

CVE-2026-46385  (opens in a new tab)
CWE-835  (opens in a new tab)

Amendment

The Centos security team deemed this advisory irrelevant for Centos:9.

NVD Description

Note: Versions mentioned in the description apply only to the upstream grafana package and not the grafana package as distributed by Centos.

iskorotkov/avro is a fast Go Avro codec. Prior to 2.33.0, the Avro array and map decoders looped over an attacker-controlled block-count value without checking the underlying reader's error state inside the loop body. Reader.ReadBlockHeader returns the count as a Go int, which is 64-bit on amd64 / arm64 targets — so a producer can declare a block of up to math.MaxInt64 (~9.2 × 10¹⁸) elements followed by EOF (or any truncated payload), and the decoder will attempt that many no-op iterations before propagating the error. The realistic ceiling is "indefinite until the worker is killed externally" — a single hostile payload pins a CPU core until the process is OOM-killed, deadline-cancelled, or terminated. Remote, unauthenticated denial-of-service. This vulnerability is fixed in 2.33.0.