Cloudanix VulnDB

GHSA-mx64-mj3q-7prj

High · 7.5

iskorotkov/avro: Denial-of-Service Vulnerability in Decoder

CVSS

7.5

EPSS

—

Published

May 18, 2026

CISA due date

—

The record

The Avro map decoder accepted attacker-controlled block-element counts from the wire format and grew the destination map without enforcing an upper bound. The slice decoder already had `Config.MaxSliceAllocSize` for the equivalent attack against arrays; the map decoder had no analogous limit, so a producer could declare an arbitrarily large map (in one block, or chunked across many sub-limit blocks) and exhaust process memory until the OOM killer fired. The fix introduces `Config.MaxMapAllocSize` with cumulative enforcement across block boundaries. **The new limit is opt-in**: the field defaults to zero, which preserves the previous unbounded behavior for backward compatibility. **Upgrading to `v2.33.0` alone does not mitigate the issue** — consumers of untrusted Avro data must explicitly set `MaxMapAllocSize` on their `avro.Config`.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities