Technical impact
The Avro decoder in the iskorotkov/avro library contained a loop that iterated over a block-count value supplied by an attacker without checking for reader errors during each iteration. The count is returned as a 64‑bit integer, allowing an attacker to specify an astronomically large number of elements in a single block. When followed by an end‑of‑file or truncated payload, the decoder performs that many no‑op iterations before noticing the error, effectively tying up a CPU core until the process is externally stopped. This flaw is a classic example of unbounded resource consumption (CWE‑400) and also constitutes an infinite loop flaw (CWE‑835), resulting in a remote, unauthenticated denial‑of‑service condition.
Affected Systems
All deployed instances of iskorotkov/avro prior to version 2.33.0 are affected. The fix was introduced in release 2.33.0; any earlier version parsing Avro data is vulnerable.
Risk and Exploitability
The CVSS score is 8.7, indicating high severity, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score of < 1% shows that the likelihood of exploitation is very low but not zero. Exploitation requires only the ability to send a crafted Avro payload to the vulnerable service, which is remotely possible because the decoder accepts untrusted input. Attackers can cause sustained high CPU usage, forcing the target application to become unresponsive until the process is killed or terminated.
Github GHSA