Skip to content
OpenAdvisories
Medium · 6.2 CVE-2026-42328 EUVD-2026-32581GHSA-w239-58x2-q8p5GO-2026-5684

go-ipld-prime: DAG-CBOR and DAG-JSON decoders unbounded recursion depth

Published May 27, 2026 · Updated May 28, 2026 · Assigned by GitHub_M

Description

go-ipld-prime is an implementation of the InterPlanetary Linked Data (IPLD) spec interfaces, a batteries-included codec implementations of IPLD for CBOR and JSON, and tooling for basic operations on IPLD objects. Prior to 0.23.0, the DAG-CBOR and DAG-JSON decoders recurse on each nested map or list without a depth limit. A payload containing deeply nested collections causes the decoder to recurse once per level, growing the goroutine stack until the Go runtime terminates the process with a fatal stack overflow (distinct from a recoverable panic). This vulnerability is fixed in 0.23.0.

Affected products

VendorProductAffectedFixed
ipld go-ipld-prime < 0.23.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
SLES for SAP 16.0 govulncheck-vulndb 0.0.20260727T201416-160000.1.1 SUSE-SU-2026:23227-1, SUSE-SU-2026:23216-1
SLES 16.0 govulncheck-vulndb 0.0.20260727T201416-160000.1.1 SUSE-SU-2026:23227-1, SUSE-SU-2026:23216-1
ReleasePackageFixed inAdvisory
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260727T201416-160000.1.1 openSUSE-SU-2026:21551-1

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling ipfs-cluster 1.1.5-r14 —
Wolfi rolling k3s-1.32 +1 1.32.13.1-r15 —
Wolfi rolling k3s-1.34 +1 1.34.6.1-r16 —
Wolfi rolling k3s-1.35 +2 1.35.3.1-r7 —
Wolfi rolling spegel 0.7.0-r2 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/ipld/go-ipld-prime < 0.23.0 0.23.0 GHSA-w239-58x2-q8p5

Advisories 3

References