Vulnerability · Published Apr 7, 2026 · Assigned by GitHub_M

CVE-2026-35480go-ipld-prime's DAG-CBOR decoder unbounded memory allocation from CBOR headers

Medium 6.2

In plain English

A medium-severity resource allocation without limits in go-ipld-prime from ipld. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.2Medium

Exploit odds (30 days)0.2%top 94.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

go-ipld-prime is an implementation of the InterPlanetary Linked Data (IPLD) spec interfaces, a batteries-included codec implementations of IPLD for CBOR and JSON, and tooling for basic operations on IPLD objects. Prior to 0.22.0, the DAG-CBOR decoder uses collection sizes declared in CBOR headers as Go preallocation hints for maps and lists. The decoder does not cap these size hints or account for their cost in its allocation budget, allowing small payloads to cause excessive memory allocation. This vulnerability is fixed in 0.22.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/ipld/go-ipld-prime	0.22.0	GHSA-378j-3jfj-8r9f
Go	github.com/ipld/go-ipld-prime	0.22.0	GO-2026-5073

Affected products (as reported)

Vendor	Product	Versions
ipld	go-ipld-prime	< 0.22.0

Weakness: CWE-770 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/ipld/go-ipld-prime/security/advisories/GHSA-378j-3jfj-8r9f x_refsource_CONFIRM