data/reports/GO-2026-5684.yaml

id: GO-2026-5684
modules:
    - module: github.com/ipld/go-ipld-prime
      versions:
        - fixed: 0.23.0
      vulnerable_at: 0.22.0
      packages:
        - package: github.com/ipld/go-ipld-prime/codec/dagcbor
          symbols:
            - Decode
        - package: github.com/ipld/go-ipld-prime/codec/dagjson
          symbols:
            - Decode
summary: |-
    Go-ipld-prime's DAG-CBOR and DAG-JSON decoders have unbounded recursion depth in
    github.com/ipld/go-ipld-prime
cves:
    - CVE-2026-42328
ghsas:
    - GHSA-w239-58x2-q8p5
references:
    - advisory: https://github.com/ipld/go-ipld-prime/security/advisories/GHSA-w239-58x2-q8p5
    - fix: https://github.com/ipld/go-ipld-prime/pull/625
source:
    id: GHSA-w239-58x2-q8p5
    created: 2026-07-23T19:02:07.668592-04:00
review_status: REVIEWED