0xiviel/

poc-avro-enum-bypass

	PoC: Avro Negative Enum Index Bypass (fastavro + Apache Avro)




	
	Summary

Both fastavro and Apache Avro Python libraries fail to validate negative enum indices. The bounds check if index >= len(symbols) misses negative values. In Python, list[-1] returns the last element, so a crafted .avro file can cause enum fields to return wrong symbol values. Confirmed on fastavro 1.12.1 and avro 1.12.1 — GUEST role becomes ADMIN.

Apache avro io.py:769: if… See the full description on the dataset page: https://huggingface.co/datasets/0xiviel/poc-avro-enum-bypass.