https://vulnerability.circl.lu/sightings/feed 2026-05-06T11:32:18.341173+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/1db0e5fe-e4cb-4d99-b5a8-47705b618cf7/export 2026-05-06T11:32:18.758861+00:00 Automation user http://vulnerability.circl.lu/user/automation {"uuid": "1db0e5fe-e4cb-4d99-b5a8-47705b618cf7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-37475", "type": "seen", "source": "https://t.me/cibsecurity/66852", "content": "\u203c CVE-2023-37475 \u203c\n\nHamba avro is a go lang encoder/decoder implementation of the avro codec specification. In affected versions a well-crafted string passed to avro's `github.com/hamba/avro/v2.Unmarshal()` can throw a `fatal error: runtime: out of memory` which is unrecoverable and can cause denial of service of the consumer of avro. The root cause of the issue is that avro uses part of the input to `Unmarshal()` to determine the size when creating a new slice and hence an attacker may consume arbitrary amounts of memory which in turn may cause the application to crash. This issue has been addressed in commit `b4a402f4` which has been included in release version `2.13.0`. Users are advised to upgrade. There are no known workarounds for this vulnerability.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-07-17T20:40:37.000000Z"} 2023-07-17T20:40:37+00:00