Answer in brief
CVE-2022-36124 records a High severity (CVSS 7.5) vulnerability in Memory overconsumption in Avro Rust SDK. The current sources do not mark it as known exploited. The current feed maps Apache Software Foundation/Apache Avro (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Apache Software Foundation/Apache Avro (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Apache Software Foundation/Apache Avrogeneric | >=unspecified <0.14.0 | 0.14.0 |
Published upstream
Aug 9, 2022
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jun 23, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 23, 2026
It is possible for a Reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to apache-avro version 0.14.0 which addresses this issue.
Quoted source text, attributed separately from HOL analysis.