Listen to this Post
How the CVE works: The Avro decoder reads attacker‑controlled 64‑bit values from the wire but converts them to platform‑sized `int` before bounds checks. On 32‑bit architectures (GOARCH=386, arm, mips, wasm), values ≥ 2³¹ truncate – e.g., (1<<32)+5 becomes 5, bypassing MaxByteSliceSize. Union indices also truncate; 1<<32 becomes 0, selecting the wrong branch. Three issues affect all platforms: 1) `arrayDecoder.Decode` and `mapDecoder.Decode` sum block lengths with `size += int(l)` – on amd64/arm64 the sum wraps at `math.MaxInt64`, evading `MaxSliceAllocSize`. 2) `ReadBlockHeader` negates `math.MinInt`, causing an overflow panic. 3) `ocf.readBlock` passes a negative wire size directly to `make([]byte, size)`, also panicking. Exploitation needs only an untrusted Avro stream, leading to DoS or, in the union‑index case, parsing data against the wrong schema. The fixes validate the 64‑bit value before narrowing, use overflow‑safe comparisons (`l > limit – size), and route skips throughSkipNBytesInt64`. Fixed in `github.com/iskorotkov/avro/v2` v2.33.0; upstream `github.com/hamba/avro/v2` is archived.
dailycve form:
Platform: Go Avro library
Version: Before v2.33.0
Vulnerability: Integer overflow/narrowing
Severity: High (DoS)
Date: 2026-05-11
Prediction: Already patched 2026-05-06
Analytics under heading What Undercode Say:
Test 32-bit truncation bypass GOARCH=386 go test -run TestDecoder_BytesLengthTruncation -v Reproduce cumulative overflow on amd64 go test -run TestDecoder_ArrayMultiBlockExceedsMaxInt -v Check affected versions go list -m -versions github.com/hamba/avro/v2 go list -m -versions github.com/iskorotkov/avro/v2 Migrate to fixed fork go mod edit -replace github.com/hamba/avro/v2=github.com/iskorotkov/avro/[email protected] go mod tidy
Exploit:
// 32-bit: union index 1<<32 selects types[bash] instead of types[bash]
data := []byte{0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00} // 1<<32 as long
var out any
avro.Unmarshal(schema, data, &out) // out becomes null or wrong type
// amd64: two-block array with count = math.MaxInt64-2 bypasses MaxSliceAllocSize
// First block 3 elements, second block MaxInt64-2 -> total wraps to MinInt64
Protection from this CVE
- Upgrade to `github.com/iskorotkov/avro/v2 >= v2.33.0`
– If using the original import path, add a `replace` directive as shown above. - If upgrade impossible: avoid decoding untrusted Avro on 32‑bit; wrap decode calls in `defer recover()` for panic paths only (does not prevent bypass errors). Isolate decoding workers.
Impact
- Denial of service via panic (OCF negative size, `math.MinInt` negation) or resource bypass (allocating huge slices/maps after wrap).
- On 32‑bit, silent truncation lets attackers exceed byte‑slice limits and select wrong union branch – may lead to logic errors if the wrong schema parses subsequent data differently. No remote code execution confirmed, but misrouting data can corrupt application state.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
