GoPackage

github.com/hamba/avro/v2

3 known vulnerabilities (3 high), with the versions each affects and the releases that fix them.

Latest release: v2.31.0 (Dec 30, 2025): affected by 2 advisories
Newest unaffected release: Every release is affected by at least one advisory
Advisories: 3 · 3 high

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-46385High 8.7
iskorotkov/avro: CPU Exhaustion in Avro Decoder
Affected: all versions.
No fix released. The latest release, v2.31.0, is still affected.
CVE-2026-46384High 8.7
iskorotkov/avro: Integer Overflow in Avro Decoder
Affected: all versions.
No fix released. The latest release, v2.31.0, is still affected.
CVE-2023-37475High 7.5
Attacker-controlled parameter can cause denial of service in hamba avro
Affected: fixed in 2.13.0.
Fixed in v2.13.0 (released Jul 16, 2023, 1 day before disclosure).
The latest release, v2.31.0, is not affected.