avro-poc-block-count-dos-2026-05-12

Apache Avro Python / fastavro - block_count DoS via negative count + null-item schema

Bug

Apache Avro Python and fastavro both trust attacker-controlled array/map block_count before validating that the declared block byte-size can contain that many items. A 110-byte Avro object container file with:

• schema {"type":"array","items":"null"}
• one block with block_count = -(2^62), block_byte_size = 0
• no item payload

triggers an unbounded range(block_count) loop. Because null items consume zero bytes, the decoder never reaches EOF validation or the array terminator. CPU is pinned indefinitely.

Verified PoC

python3 repro.py

Output:

apache_avro_version=1.12.1
fastavro_version=1.12.2
apache-avro: TIMEOUT after 5.01s on 110 bytes
fastavro: TIMEOUT after 5.00s on 110 bytes

Sentinel written: /tmp/AVRO_BLOCK_COUNT_DOS.txt.

Affected versions

• avro==1.12.1 (apache/avro 4c29cfb234c6ca0d9df8a572ca04b65ccc7c21e4)
• fastavro==1.12.2 (fastavro e547e5fc46abb81c19b1b77adfc0664998ee7807)

Affected files

• apache/avro lang/py/avro/io.py:783-806 (DatumReader.read_array)
• apache/avro lang/py/avro/io.py:820-844 (map equivalent)
• fastavro fastavro/_read.pyx:363-412 (read_array)
• fastavro fastavro/_read.pyx:444-494 (map equivalent)
• fastavro fastavro/io/binary_decoder.py:106-124 (_iter_array_or_map pure-Python fallback)

Severity

CVSS 3.1 5.5 Medium (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). CWE-400 Uncontrolled Resource Consumption.

Distinguisher from prior CVEs

• AVRO-4228: C++ BinaryDecoder::arrayNext() negative-block-count bug, fixed for 1.13.0 — does not cover Python paths
• Recent Apache Avro C fixes: validate negative block sizes in C datafile/binary decoders — does not cover Python
• Java currently has collection byte availability hardening — does not cover Python

This is the FIRST report of the Python/fastavro path of this class.

Reporter

Tony Davis (lendtrain on huntr) — 2026-05-12. PoC by codex agent in parallel session.