{"id":"EUVD-2026-32581","enisaUuid":"a956eae1-6b46-3344-92e1-ca9c69468b59","description":"go-ipld-prime is an implementation of the InterPlanetary Linked Data (IPLD) spec interfaces, a batteries-included codec implementations of IPLD for CBOR and JSON, and tooling for basic operations on IPLD objects. Prior to 0.23.0, the DAG-CBOR and DAG-JSON decoders recurse on each nested map or list without a depth limit. A payload containing deeply nested collections causes the decoder to recurse once per level, growing the goroutine stack until the Go runtime terminates the process with a fatal stack overflow (distinct from a recoverable panic). This vulnerability is fixed in 0.23.0.","datePublished":"May 27, 2026, 4:31:38 PM","dateUpdated":"May 28, 2026, 2:14:09 PM","baseScore":6.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/ipld/go-ipld-prime/security/advisories/GHSA-w239-58x2-q8p5\n","aliases":"CVE-2026-42328\nGHSA-w239-58x2-q8p5\n","assigner":"GitHub_M","epss":0.12,"enisaIdProduct":[{"id":"14991c9b-ddab-3c28-9813-fdd9f67d2777","product":{"name":"go-ipld-prime","vendor":{"name":"ipld"}},"product_version":"\u003c 0.23.0"}],"enisaIdVendor":[{"id":"8afee862-0ed3-39dd-8f6f-02e1597b2501","vendor":{"name":"ipld"}}],"enisaIdVulnerability":[{"id":"44416223-40a8-3295-875e-88e056d01ed6","vulnerability":{"id":"GHSA-w239-58x2-q8p5","description":"go-ipld-prime\u0027s DAG-CBOR and DAG-JSON decoders have unbounded recursion depth","datePublished":"May 7, 2026, 2:07:21 AM","dateUpdated":"Jun 8, 2026, 11:47:37 PM","baseScore":0.0,"references":"https://github.com/ipld/go-ipld-prime/security/advisories/GHSA-w239-58x2-q8p5\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-42328\nhttps://github.com/ipld/go-ipld-prime\n","enisa_id":"EUVD-2026-32581\n","aliases":"CVE-2026-42328\nGHSA-w239-58x2-q8p5\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:00:21 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"716113f7-7ff2-32ff-841c-db4237482e48","vulnerability":{"id":"CVE-2026-42328","description":"go-ipld-prime is an implementation of the InterPlanetary Linked Data (IPLD) spec interfaces, a batteries-included codec implementations of IPLD for CBOR and JSON, and tooling for basic operations on IPLD objects. Prior to 0.23.0, the DAG-CBOR and DAG-JSON decoders recurse on each nested map or list without a depth limit. A payload containing deeply nested collections causes the decoder to recurse once per level, growing the goroutine stack until the Go runtime terminates the process with a fatal stack overflow (distinct from a recoverable panic). This vulnerability is fixed in 0.23.0.","datePublished":"May 27, 2026, 4:31:38 PM","dateUpdated":"May 28, 2026, 2:14:09 PM","status":"PUBLISHED","baseScore":6.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/ipld/go-ipld-prime/security/advisories/GHSA-w239-58x2-q8p5\n","enisa_id":"EUVD-2026-32581\n","assigner":"GitHub_M","epss":0.12,"dataProcessed":"Nov 7, 2026, 7:21:17 AM","vulnerabilityProduct":[{"id":"42e25988-c114-3a74-9979-b2bfdb2ee9eb","product":{"name":"go-ipld-prime","vendor":{"name":"ipld"}},"product_version":"\u003c 0.23.0"}],"vulnerabilityVendor":[{"id":"0d8ac440-aa02-3fde-8668-2849ac2bba29","vendor":{"name":"ipld"}}]}}],"enisaIdAdvisory":[]}