packages:
  - module: github.com/ipld/go-car
    versions:
      - fixed: 0.4.0
    vulnerable_at: 0.3.3
  - module: github.com/ipld/go-car
    package: github.com/ipld/go-car/util
    versions:
      - fixed: 0.4.0
    vulnerable_at: 0.3.3
  - module: github.com/ipld/go-car/v2
    versions:
      - introduced: 2.0.0
        fixed: 2.4.0
    vulnerable_at: 2.3.0
  - module: github.com/ipld/go-car/v2
    package: github.com/ipld/go-car/v2/blockstore
    versions:
      - introduced: 2.0.0
        fixed: 2.4.0
    vulnerable_at: 2.3.0
  - module: github.com/ipld/go-car/v2
    package: github.com/ipld/go-car/v2/index
    versions:
      - introduced: 2.0.0
        fixed: 2.4.0
    vulnerable_at: 2.3.0
description: |
    Decoding malformed CAR data can cause panics or excessive memory usage.
ghsas:
  - GHSA-9x4h-8wgm-8xfg
links:
    advisory: https://github.com/advisories/GHSA-9x4h-8wgm-8xfg