PT-2026-30757 · Unknown · Go-Ipld-Prime

Yuliyu123 · Published 2026-04-06 · Updated 2026-04-14 · CVE-2026-35480

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions go-ipld-prime versions prior to 0.22.0

Description go-ipld-prime’s DAG-CBOR decoder does not limit the size of preallocations for maps and lists based on CBOR headers, potentially leading to excessive memory allocation from small payloads. Nested structures can exacerbate this issue, causing allocations exceeding 9GB from payloads under 100 bytes. The decoder uses collection sizes from CBOR headers as preallocation hints for Go maps and lists, without accounting for the cost in its allocation budget.

Recommendations Update to version 0.22.0 or later.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-35480

GHSA-378J-3JFJ-8R9F

OPENSUSE-SU-2026:10543-1

Affected Products

Go-Ipld-Prime

References · 11

• https://github.com/ipld/go-ipld-prime/security/advisories/GHSA-378j-3jfj-8r9f · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10543-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35480 · Security Note
• https://osv.dev/vulnerability/GHSA-378j-3jfj-8r9f · Vendor Advisory
• https://github.com/ipld/go-ipld-prime · Note
• https://github.com/ipld/go-ipld-prime/commit/e43bf4a27055fe8d895671a731ee5041e2d983a9 · Note
• https://github.com/ipld/go-ipld-prime/releases/tag/v0.22.0 · Note
• https://suse.com/security/cve/CVE-2026-35480 · Note
• https://twitter.com/CVEnew/status/2041603232326095291 · Twitter Post
• https://suse.com/security/cve/CVE-2025-58181 · Note
• https://suse.com/security/cve/CVE-2025-58190 · Note