{"id":"GO-2023-1930","summary":"Unrestricted memory consumption in github.com/hamba/avro","details":"Unrestricted memory consumption in github.com/hamba/avro","aliases":["CVE-2023-37475","GHSA-9x44-9pgq-cf45"],"modified":"2026-02-04T03:29:50.273886Z","published":"2023-07-25T22:53:22Z","related":["CGA-672c-733h-6rcg"],"database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2023-1930"},"references":[{"type":"ADVISORY","url":"https://github.com/hamba/avro/security/advisories/GHSA-9x44-9pgq-cf45"},{"type":"FIX","url":"https://github.com/hamba/avro/pull/273"}],"affected":[{"package":{"name":"github.com/hamba/avro/v2","ecosystem":"Go","purl":"pkg:golang/github.com/hamba/avro/v2"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.13.0"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/hamba/avro/v2","symbols":["Decoder.Decode","Reader.ReadArrayCB","Reader.ReadBytes","Reader.ReadMapCB","Reader.ReadNext","Reader.ReadString","Reader.ReadVal","Reader.readBytes","Unmarshal","arrayDecoder.Decode","bytesCodec.Decode","bytesDecimalCodec.Decode","bytesDecimalPtrCodec.Decode","dereferenceDecoder.Decode","efaceDecoder.Decode","frozenConfig.Unmarshal","mapDecoder.Decode","mapSkipDecoder.Decode","mapUnionDecoder.Decode","recordIfaceDecoder.Decode","recordMapDecoder.Decode","recordSkipDecoder.Decode","referenceDecoder.Decode","sliceSkipDecoder.Decode","stringCodec.Decode","structDecoder.Decode","textMarshalerCodec.Decode","unionPtrDecoder.Decode","unionResolvedDecoder.Decode","unionSkipDecoder.Decode"]}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2023-1930.json"}},{"package":{"name":"github.com/hamba/avro","ecosystem":"Go","purl":"pkg:golang/github.com/hamba/avro"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/hamba/avro","symbols":["Decoder.Decode","Reader.ReadArrayCB","Reader.ReadBytes","Reader.ReadMapCB","Reader.ReadNext","Reader.ReadString","Reader.ReadVal","Unmarshal","arrayDecoder.Decode","bytesCodec.Decode","bytesDecimalCodec.Decode","bytesDecimalPtrCodec.Decode","dereferenceDecoder.Decode","efaceDecoder.Decode","frozenConfig.Unmarshal","mapDecoder.Decode","mapSkipDecoder.Decode","mapUnionDecoder.Decode","recordIfaceDecoder.Decode","recordMapDecoder.Decode","recordSkipDecoder.Decode","referenceDecoder.Decode","sliceSkipDecoder.Decode","stringCodec.Decode","structDecoder.Decode","textMarshalerCodec.Decode","unionPtrDecoder.Decode","unionResolvedDecoder.Decode","unionSkipDecoder.Decode"]}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2023-1930.json"}}],"schema_version":"1.7.3"}