CVE-2026-35480 json
go-ipld-prime's DAG-CBOR decoder unbounded memory allocation from CBOR headers
published 2026-04-06 7 mo ago modified 2026-10-26 13 d ago also EUVD-2026-19663 , GHSA-378j-3jfj-8r9f , GO-2026-5073
- cvss
- 6.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 5%
- public exploits
- 0
- none known
Summary
go-ipld-prime is an implementation of the InterPlanetary Linked Data (IPLD) spec interfaces, a batteries-included codec implementations of IPLD for CBOR and JSON, and tooling for basic operations on IPLD objects. Prior to 0.22.0, the DAG-CBOR decoder uses collection sizes declared in CBOR headers as Go preallocation hints for maps and lists. The decoder does not cap these size hints or account for their cost in its allocation budget, allowing small payloads to cause excessive memory allocation. This vulnerability is fixed in 0.22.0.
Patch / fix
- go github.com/ipld/go-ipld-prime 0.22.0
- protocol go-ipld-prime 0.22.0
- govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
- kubo openSUSE Tumbleweed 0.40.1-1.1
opensuse advisories openSUSE-SU-2026:21483-1openSUSE-SU-2026:10543-1
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 7 mo ago
Exploit prediction
0.16% chance of exploitation in the next 30 days, higher than 5% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.2 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 6.2 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/ipld/go-ipld-prime | <0.22.0 |
0.22.0 |
Affected products
- ipld go-ipld-prime
Classification
- Weakness
-
- CWE-770 Allocation of Resources Without Limits or Throttling
References
-
github.com
/ipld/go-ipld-prime/commit/e43bf4a27055fe8d895671a731ee5041e2d983a9
web, patch
-
github.com
/ipld/go-ipld-prime/security/advisories/GHSA-378j-3jfj-8r9f
web, vendor-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-35480
advisory
-
github.com
/ipld/go-ipld-prime
package
-
github.com
/ipld/go-ipld-prime/releases/tag/v0.22.0
web
Sources
- CVE List CVE-2026-35480
- GitHub Advisory GHSA-378j-3jfj-8r9f
- NVD CVE-2026-35480
- OSV GO-2026-5073
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.