id: GO-2023-1930
modules:
    - module: github.com/hamba/avro/v2
      versions:
        - fixed: 2.13.0
      vulnerable_at: 2.12.0
      packages:
        - package: github.com/hamba/avro/v2
          symbols:
            - Reader.readBytes
          derived_symbols:
            - Decoder.Decode
            - Reader.ReadArrayCB
            - Reader.ReadBytes
            - Reader.ReadMapCB
            - Reader.ReadNext
            - Reader.ReadString
            - Reader.ReadVal
            - Unmarshal
            - arrayDecoder.Decode
            - bytesCodec.Decode
            - bytesDecimalCodec.Decode
            - bytesDecimalPtrCodec.Decode
            - dereferenceDecoder.Decode
            - efaceDecoder.Decode
            - frozenConfig.Unmarshal
            - mapDecoder.Decode
            - mapSkipDecoder.Decode
            - mapUnionDecoder.Decode
            - recordIfaceDecoder.Decode
            - recordMapDecoder.Decode
            - recordSkipDecoder.Decode
            - referenceDecoder.Decode
            - sliceSkipDecoder.Decode
            - stringCodec.Decode
            - structDecoder.Decode
            - textMarshalerCodec.Decode
            - unionPtrDecoder.Decode
            - unionResolvedDecoder.Decode
            - unionSkipDecoder.Decode
    - module: github.com/hamba/avro
      vulnerable_at: 1.8.0
      packages:
        - package: github.com/hamba/avro
          symbols:
            - Reader.ReadBytes
            - Reader.ReadString
          derived_symbols:
            - Decoder.Decode
            - Reader.ReadArrayCB
            - Reader.ReadMapCB
            - Reader.ReadNext
            - Reader.ReadVal
            - Unmarshal
            - arrayDecoder.Decode
            - bytesCodec.Decode
            - bytesDecimalCodec.Decode
            - bytesDecimalPtrCodec.Decode
            - dereferenceDecoder.Decode
            - efaceDecoder.Decode
            - frozenConfig.Unmarshal
            - mapDecoder.Decode
            - mapSkipDecoder.Decode
            - mapUnionDecoder.Decode
            - recordIfaceDecoder.Decode
            - recordMapDecoder.Decode
            - recordSkipDecoder.Decode
            - referenceDecoder.Decode
            - sliceSkipDecoder.Decode
            - stringCodec.Decode
            - structDecoder.Decode
            - textMarshalerCodec.Decode
            - unionPtrDecoder.Decode
            - unionResolvedDecoder.Decode
            - unionSkipDecoder.Decode
summary: Unrestricted memory consumption in github.com/hamba/avro
cves:
    - CVE-2023-37475
ghsas:
    - GHSA-9x44-9pgq-cf45
references:
    - advisory: https://github.com/hamba/avro/security/advisories/GHSA-9x44-9pgq-cf45
    - fix: https://github.com/hamba/avro/pull/273
review_status: REVIEWED