CVE-2026-35480
Medium
Description
go-ipld-prime is an implementation of the InterPlanetary Linked Data (IPLD) spec interfaces, a batteries-included codec implementations of IPLD for CBOR and JSON, and tooling for basic operations on IPLD objects. Prior to 0.22.0, the DAG-CBOR decoder uses collection sizes declared in CBOR headers as Go preallocation hints for maps and lists. The decoder does not cap these size hints or account for their cost in its allocation budget, allowing small payloads to cause excessive memory allocation. This vulnerability is fixed in 0.22.0.
SeverityMedium
CVSS6.2
Exploit probability—
ProductProtocol Go-ipld-prime
PublishedApr 7, 2026
First seenApr 7, 2026
Weakness typeCWE-770Allocation of resources without limits
How to fix
Update
- protocol go-ipld-prime0.22.0 or later
- github.com/ipld/go-ipld-prime0.22.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| protocol go-ipld-prime | v < 0.22.0 | 0.22.0 |
| github.com/ipld/go-ipld-primeGo | v < 0.22.0 | 0.22.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.