CVE-2026-42328
MEDIUM EPSS 2.2%
Published May 27, 20261mo ago · Modified Jun 17, 20262w ago
6.2 CVSS 3.1
Published May 27, 2026 1mo ago
Last Modified Jun 17, 2026 2w ago
Description
go-ipld-prime is an implementation of the InterPlanetary Linked Data (IPLD) spec interfaces, a batteries-included codec implementations of IPLD for CBOR and JSON, and tooling for basic operations on IPLD objects. Prior to 0.23.0, the DAG-CBOR and DAG-JSON decoders recurse on each nested map or list without a depth limit. A payload containing deeply nested collections causes the decoder to recurse once per level, growing the goroutine stack until the Go runtime terminates the process with a fatal stack overflow (distinct from a recoverable panic). This vulnerability is fixed in 0.23.0.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Attack Vector Local
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High
Threat Intelligence
EPSS Exploit Probability
2.2% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-674
References 1
- github.com https://github.com/ipld/go-ipld-prime/security/advisories/GHSA-w239-58x2-q8p5
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.