PT-2026-38369 · Go+1 · Github.Com/Ipld/Go-Ipld-Prime+1

Yuliyu123 · Published 2026-05-07 · Updated 2026-05-27 · CVE-2026-42328

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions go-ipld-prime versions prior to 0.23.0

Description The DAG-CBOR and DAG-JSON decoders recurse on each nested map or list without a depth limit. A payload containing deeply nested collections causes the decoder to recurse once per level, growing the goroutine stack until the Go runtime terminates the process with a fatal stack overflow. For DAG-CBOR, a payload of approximately 2 MB consisting of repeated 0x81 bytes followed by a terminator can exhaust the default 1 GB goroutine stack. DAG-JSON is similarly exposed via [[[...]]]-style payloads. Schema-free decoding using basicnode.Prototype.Any allows arbitrary nesting depth, while schema-bound decoding only limits nesting if the schema is non-recursive and contains no fields typed as Any.

Recommendations Update to version 0.23.0.

Fix

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

CVE-2026-42328

GHSA-W239-58X2-Q8P5

Affected Products

Github.Com/Ipld/Go-Ipld-Prime

Go-Ipld-Prime

References · 4

• https://osv.dev/vulnerability/GHSA-w239-58x2-q8p5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42328 · Security Note
• https://github.com/ipld/go-ipld-prime/security/advisories/GHSA-w239-58x2-q8p5 · Note
• https://github.com/ipld/go-ipld-prime · Note