Allocation of Resources Without Limits or Throttling Affecting github.com/iskorotkov/avro package, versions <2.33.0
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Allocation of Resources Without Limits or Throttling vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-GOLANG-GITHUBCOMISKOROTKOVAVRO-18365726
- published28 Jul 2026
- disclosed27 Jul 2026
- creditIvan Korotkov, Daniel Błażewicz
Introduced: 27 Jul 2026
CVE NOT AVAILABLE CWE-770 (opens in a new tab)How to fix?
Upgrade github.com/iskorotkov/avro to version 2.33.0 or higher.
Overview
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the mapDecoder.Decode and mapDecoderUnmarshaler.Decode methods in codec_map.go, which use the attacker-controlled map block element count both to pre-size the destination map and as the read loop bound with no per-block or cumulative upper limit. An attacker can exhaust process memory and terminate the process with an out-of-memory error by supplying Avro data whose map block header declares a very large element count, or by splitting a large map across many small blocks that accumulate past any per-block threshold. Exploitation requires the application to decode untrusted Avro data containing map structures.
Workaround
This vulnerability can be avoided by decoding untrusted Avro in a memory-constrained child process or cgroup, bounding any oversized map allocation so it cannot exhaust the whole host.