CVE catalog

CVE-2026-35480

go-ipld-prime is an implementation of the InterPlanetary Linked Data (IPLD) spec interfaces, a batteries-included codec implementations of IPLD for CBOR and JSON, and tooling for basic operations on I

[CVE catalog]

Severity
Medium · CVSS 6.2CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.16% · Oct 25, 2026

go-ipld-prime is an implementation of the InterPlanetary Linked Data (IPLD) spec interfaces, a batteries-included codec implementations of IPLD for CBOR and JSON, and tooling for basic operations on IPLD objects. Prior to 0.22.0, the DAG-CBOR decoder uses collection sizes declared in CBOR headers as Go preallocation hints for maps and lists. The decoder does not cap these size hints or account for their cost in its allocation budget, allowing small payloads to cause excessive memory allocation. This vulnerability is fixed in 0.22.0.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Cpego-ipld-primeNot reported0.22.0fixed
Gogithub.com/ipld/go-ipld-primeNot reported0.22.0fixed
Cpego-ipld-primeNot reported0.22.0fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Cpego-ipld-primecpeNot reported0.22.0Not reportedNot reportedNot reported
Gogithub.com/ipld/go-ipld-primeGoNot reported0.22.0Not reportedNot reportedNot reported
Cpego-ipld-primecpeNot reported0.22.0Not reportedNVD-CVE-2026-35480Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[FIRST EPSS] · [Go Vulnerability Database] · [National Vulnerability Database (NVD)] · [SUSE security advisories and VEX]