CVE-2026-42328 go-ipld-prime: DAG-CBOR and DAG-JSON decoders unbounded recursion depth

What is CVE-2026-42328?

CVE-2026-42328 is a medium-severity denial of service vulnerability in go-ipld-prime, published on 27 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

go-ipld-prime is an implementation of the InterPlanetary Linked Data (IPLD) spec interfaces, a batteries-included codec implementations of IPLD for CBOR and JSON, and tooling for basic operations on IPLD objects. Prior to 0.23.0, the DAG-CBOR and DAG-JSON decoders recurse on each nested map or list without a depth limit. A payload containing deeply nested collections causes the decoder to recurse once per level, growing the goroutine stack until the Go runtime terminates the process with a fatal stack overflow (distinct from a recoverable panic). This vulnerability is fixed in 0.23.0.

Weakness: CWE-674

Which versions are affected by CVE-2026-42328?

3 open source packages ship an affected version, including github.com/ipld/go-ipld-prime.

How do I fix CVE-2026-42328?

Upgrade github.com/ipld/go-ipld-prime to 0.23.0 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-42328 being exploited?

There is no known exploitation of CVE-2026-42328 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-w239-58x2-q8p5, GO-2026-5684, MINI-456h-qq37-p46f, MINI-xmh3-45pm-pfwf.