CVE-2026-35480

MediumCVSS 6.2

Published: 07/04/2026(UTC)Updated: 26/10/2026(UTC)Translated: 27/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

5th percentile - higher than 5% of all known CVEs

Summary

In go-ipld-prime prior to 0.22.0, the DAG-CBOR decoder uses collection sizes declared in CBOR headers as Go preallocation hints without capping them. Small payloads can cause excessive memory allocation.

Risk Assessment

An attacker could send a small payload causing excessive memory consumption, potentially leading to resource exhaustion and denial of service.

Recommendation

Update go-ipld-prime to version 0.22.0 or later.

Other vulnerabilities in go-ipld-prime

CVE-2023-22460High
go-ipld-prime is an implementation of the IPLD spec. When encoding data containing a Bytes kind Node, a Bytes token is passed to the JSON encoder, which panics because JSON should not encode binary data. This only affects the 'json' codec, not 'dag-json' or the decoder. The issue is fixed in v0.19.0.

Original NVD description (English source)

go-ipld-prime is an implementation of the InterPlanetary Linked Data (IPLD) spec interfaces, a batteries-included codec implementations of IPLD for CBOR and JSON, and tooling for basic operations on IPLD objects. Prior to 0.22.0, the DAG-CBOR decoder uses collection sizes declared in CBOR headers as Go preallocation hints for maps and lists. The decoder does not cap these size hints or account for their cost in its allocation budget, allowing small payloads to cause excessive memory allocation. This vulnerability is fixed in 0.22.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS