CVE-2026-35480 go-ipld-prime's DAG-CBOR decoder unbounded memory allocation from CBOR headers
An attacker can cause excessive memory allocation and denial of service by sending crafted CBOR payloads to the go-ipld-prime decoder.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-35480?
CVE-2026-35480 is a medium-severity denial of service vulnerability in go-ipld-prime, published on 7 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
go-ipld-prime is an implementation of the InterPlanetary Linked Data (IPLD) spec interfaces, a batteries-included codec implementations of IPLD for CBOR and JSON, and tooling for basic operations on IPLD objects. Prior to 0.22.0, the DAG-CBOR decoder uses collection sizes declared in CBOR headers as Go preallocation hints for maps and lists. The decoder does not cap these size hints or account for their cost in its allocation budget, allowing small payloads to cause excessive memory allocation. This vulnerability is fixed in 0.22.0.
Weakness: CWE-770
Which versions are affected by CVE-2026-35480?
3 open source packages ship an affected version, including github.com/ipld/go-ipld-prime. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/ipld/go-ipld-prime Go | All versions | 0.22.0 |
github.com/ipld/go-ipld-prime Go | All versions | 0.22.0 |
github.com/ipld/go-ipld-prime Go | All versions | 0.22.0 |
Products include Protocol Go-Ipld-Prime.
How do I fix CVE-2026-35480?
Upgrade github.com/ipld/go-ipld-prime to 0.22.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-35480 being exploited?
There is no known exploitation of CVE-2026-35480 in the wild and no public exploit code.
Other vulnerabilities in go-ipld-prime
Sources
Also known as GHSA-378j-3jfj-8r9f, GO-2026-5073, MINI-hf9w-8rw7-4rvf, MINI-wqwj-cpw9-4q92.