PT-2023-25986 · Avro · Avro

Adamkorcz · Published 2023-07-17 · Updated 2026-05-18 · CVE-2023-37475

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions github.com/hamba/avro versions prior to 2.13.0

Description A well-crafted string passed to avro's github.com/hamba/avro/v2.Unmarshal() can throw a fatal error: runtime: out of memory which is unrecoverable and can cause denial of service of the consumer of avro. The root cause of the issue is that avro uses part of the input to Unmarshal() to determine the size when creating a new slice and hence an attacker may consume arbitrary amounts of memory which in turn may cause the application to crash.

Recommendations To resolve the issue, upgrade to version 2.13.0 or later. As a temporary workaround, consider restricting the use of the Unmarshal() function to trusted input only, until a patch is available. Avoid using the Unmarshal() function with untrusted input to minimize the risk of exploitation.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2023-37475

GHSA-9X44-9PGQ-CF45

GO-2023-1930

Affected Products

Avro

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37475.json · Exploit
• 🔥 https://github.com/hamba/avro/security/advisories/GHSA-9x44-9pgq-cf45 · Exploit
• https://github.com/hamba/avro/commit/b4a402f41cf44b6094b5131286830ba9bb1eb290 · Patch
• https://osv.dev/vulnerability/GHSA-9x44-9pgq-cf45 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-37475 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-37475 · Security Note
• https://osv.dev/vulnerability/GO-2023-1930 · Vendor Advisory
• https://github.com/hamba/avro/releases/tag/v2.13.0 · Note
• https://github.com/hamba/avro/blob/3abfe1e6382c5dccf2e1a00260c51a64bc1f1ca1/reader.go#L216-L242 · Note
• https://github.com/hamba/avro · Note
• https://github.com/hamba/avro/pull/273 · Note
• https://t.me/cibsecurity/66852 · Telegram Post
• https://t.me/cvenotify/54486 · Telegram Post
• https://twitter.com/dailycve/status/2056432082402918671 · Twitter Post
• https://t.me/cvenotify/55249 · Telegram Post