Cloudanix VulnDB

CVE-2026-35480

Medium · 6.2

CVSS

6.2

EPSS

0.2%

Published

Apr 7, 2026

CISA due date

—

The record

go-ipld-prime is an implementation of the InterPlanetary Linked Data (IPLD) spec interfaces, a batteries-included codec implementations of IPLD for CBOR and JSON, and tooling for basic operations on IPLD objects. Prior to 0.22.0, the DAG-CBOR decoder uses collection sizes declared in CBOR headers as Go preallocation hints for maps and lists. The decoder does not cap these size hints or account for their cost in its allocation budget, allowing small payloads to cause excessive memory allocation. This vulnerability is fixed in 0.22.0.

Affected packages

Ecosystem Package Introduced Fixed
Chainguard ipfs-cluster 0 1.1.5-r11
Chainguard k3s-1.32 0 1.32.13.1-r10
Chainguard k3s-1.33 0 1.33.10.1-r3
Chainguard k3s-static-1.32 0 1.32.13.1-r10
Chainguard k3s-static-1.33 0 1.33.10.1-r3
Chainguard spegel 0 0.6.0-r11
Chainguard spegel-fips 0 0.6.0-r8
Wolfi ipfs-cluster 0 1.1.5-r11
Wolfi k3s-1.32 0 1.32.13.1-r10
Wolfi k3s-1.33 0 1.33.10.1-r3
Wolfi k3s-static-1.32 0 1.32.13.1-r10
Wolfi k3s-static-1.33 0 1.33.10.1-r3
Wolfi spegel 0 0.6.0-r11
openSUSE:Tumbleweed kubo 0 0.40.1-1.1

Related vulnerabilities