TI-2026-30634 Aliases CVE-2026-42328 GHSA-w239-58x2-q8p5

go-ipld-prime: DAG-CBOR and DAG-JSON decoders unbounded recursion depth

LOW 26CWE-674Published 2026-05-27 · Updated 2026-05-28

Key facts

Attack vector: Local
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-674.

Summary

go-ipld-prime is an implementation of the InterPlanetary Linked Data (IPLD) spec interfaces, a batteries-included codec implementations of IPLD for CBOR and JSON, and tooling for basic operations on IPLD objects. Prior to 0.23.0, the DAG-CBOR and DAG-JSON decoders recurse on each nested map or list without a depth limit. A payload containing deeply nested collections causes the decoder to recurse once per level, growing the goroutine stack until the Go runtime terminates the process with a fatal stack overflow (distinct from a recoverable panic). This vulnerability is fixed in 0.23.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0012 1st percentileScored 2026-11-07

Fix Fixed go-ipld-prime (ipld): 0.23.0github.com/ipld/go-ipld-prime (Go): 0.23.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ipld	go-ipld-prime	before 0.23.0	0.23.0	Patch available	CNA
—	github.com/ipld/go-ipld-prime (Go)	before 0.23.0	0.23.0	Patch available	GHSA-w239-58x2-q8p5

go-ipld-prime Vendoripld Affected before 0.23.0 Fixed in 0.23.0 Patch available CNA
github.com/ipld/go-ipld-prime (Go) Vendor— Affected before 0.23.0 Fixed in 0.23.0 Patch available GHSA-w239-58x2-q8p5

Remediation

Fix · CNA go-ipld-prime (ipld) Fixed in 0.23.0
Fix · GHSA-w239-58x2-q8p5 github.com/ipld/go-ipld-prime (Go) Fixed in 0.23.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-42328
2026-10-03 Alias added: GHSA-w239-58x2-q8p5

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-42328

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences