Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| ipld | go-ipld-prime | affected |
|
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
No data.
Project Subscriptions
No data.
| Source | ID | Title |
|---|---|---|
 Github GHSA |
GHSA-w239-58x2-q8p5 | go-ipld-prime's DAG-CBOR and DAG-JSON decoders have unbounded recursion depth |
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
Wed, 27 May 2026 17:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | go-ipld-prime is an implementation of the InterPlanetary Linked Data (IPLD) spec interfaces, a batteries-included codec implementations of IPLD for CBOR and JSON, and tooling for basic operations on IPLD objects. Prior to 0.23.0, the DAG-CBOR and DAG-JSON decoders recurse on each nested map or list without a depth limit. A payload containing deeply nested collections causes the decoder to recurse once per level, growing the goroutine stack until the Go runtime terminates the process with a fatal stack overflow (distinct from a recoverable panic). This vulnerability is fixed in 0.23.0. | |
| Title | go-ipld-prime: DAG-CBOR and DAG-JSON decoders unbounded recursion depth | |
| Weaknesses | CWE-674 | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-05-27T16:31:38.090Z
Reserved: 2026-04-26T12:37:18.171Z
Link: CVE-2026-42328
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-05-27T18:16:22.653
Modified: 2026-05-27T18:16:22.653
Link: CVE-2026-42328
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-05-27T19:30:35Z