Skip to content
Heist/ feed
Back to feed
Medium

go-ipld-prime's DAG-CBOR decoder unbounded memory allocation from CBOR headers

Type: advisorySources: OSV

go-ipld-prime is an implementation of the InterPlanetary Linked Data (IPLD) spec interfaces, a batteries-included codec implementations of IPLD for CBOR and JSON, and tooling for basic operations on IPLD objects. Prior to 0.22.0, the DAG-CBOR decoder uses collection sizes declared in CBOR headers as Go preallocation hints for maps and lists. The decoder does not cap these size hints or account for their cost in its allocation budget, allowing small payloads to cause excessive memory allocation. This vulnerability is fixed in 0.22.0.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-35480
Confirmed fixed CVEs
Not specified
Updated in this feed
2 Nov 2026, 17:19 UTC · Revision 1

Source evidence

go-ipld-prime's DAG-CBOR decoder unbounded memory allocation from CBOR headers

core-osv · Original source

Published 7 Apr 2026, 14:43 UTC

go-ipld-prime is an implementation of the InterPlanetary Linked Data (IPLD) spec interfaces, a batteries-included codec implementations of IPLD for CBOR and JSON, and tooling for basic operations on IPLD objects. Prior to 0.22.0, the DAG-CBOR decoder uses collection sizes declared in CBOR headers as Go preallocation hints for maps and lists. The decoder does not cap these size hints or account for their cost in its allocation budget, allowing small payloads to cause excessive memory allocation. This vulnerability is fixed in 0.22.0.

osv:CVE-2026-35480
Complete source record
{
  "id": "8682eca7beaee506e0c7178c2bc066c116fbcabf3a70e93c4334850dc97039fc",
  "url": "https://osv.dev/vulnerability/CVE-2026-35480",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "go-ipld-prime's DAG-CBOR decoder unbounded memory allocation from CBOR headers",
    "summary": "go-ipld-prime is an implementation of the InterPlanetary Linked Data (IPLD) spec interfaces, a batteries-included codec implementations of IPLD for CBOR and JSON, and tooling for basic operations on IPLD objects. Prior to 0.22.0, the DAG-CBOR decoder uses collection sizes declared in CBOR headers as Go preallocation hints for maps and lists. The decoder does not cap these size hints or account for their cost in its allocation budget, allowing small payloads to cause excessive memory allocation. This vulnerability is fixed in 0.22.0.",
    "evidence": "osv:CVE-2026-35480",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-35480",
      "aliases": [
        "CVE-2026-35480",
        "GHSA-378j-3jfj-8r9f",
        "GO-2026-5073"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/ipld/go-ipld-prime",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "75f643e10510431a35ac0b62e9ecc7da0a9273c3"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "0.22.0"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "cpe": "cpe:2.3:a:protocol:go-ipld-prime:*:*:*:*:*:go:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "0.22.0"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v0.21.0",
            "v0.20.0",
            "v0.19.0",
            "v0.18.0",
            "v0.17.0",
            "v0.16.0",
            "v0.14.4",
            "v0.14.3",
            "v0.14.2",
            "v0.14.1",
            "v0.14.0",
            "v0.12.3",
            "v0.12.2",
            "v0.12.1",
            "v0.12.0",
            "v0.11.0",
            "v0.10.0",
            "v0.9.0",
            "v0.7.0",
            "v0.6.0",
            "v0.5.0",
            "v0.5",
            "v0.4.0",
            "v0.4",
            "v0.0.3",
            "v0.0.2",
            "v0.0.1-filecoin",
            "v0.0.1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35480.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:21.373484960Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35480.json",
        "https://github.com/ipld/go-ipld-prime/security/advisories/GHSA-378j-3jfj-8r9f",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-35480"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-770"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35480.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-35480",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 487679,
  "published_at": "2026-04-07T14:43:24.781+00:00"
}