CVE-2026-42328

{
  "id": "CVE-2026-42328",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-27T18:16:22.653",
  "lastModified": "2026-10-26T11:10:00.157",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "go-ipld-prime is an implementation of the InterPlanetary Linked Data (IPLD) spec interfaces, a batteries-included codec implementations of IPLD for CBOR and JSON, and tooling for basic operations on IPLD objects. Prior to 0.23.0, the DAG-CBOR and DAG-JSON decoders recurse on each nested map or list without a depth limit. A payload containing deeply nested collections causes the decoder to recurse once per level, growing the goroutine stack until the Go runtime terminates the process with a fatal stack overflow (distinct from a recoverable panic). This vulnerability is fixed in 0.23.0."
    },
    {
      "lang": "es",
      "value": "go-ipld-prime es una implementación de las interfaces de la especificación de InterPlanetary Linked Data (IPLD), implementaciones de códec de IPLD con todo incluido para CBOR y JSON, y herramientas para operaciones básicas en objetos IPLD. Antes de la 0.23.0, los decodificadores DAG-CBOR y DAG-JSON recurren en cada mapa o lista anidada sin un límite de profundidad. Una carga útil que contiene colecciones profundamente anidadas hace que el decodificador recurra una vez por nivel, haciendo crecer la pila de goroutines hasta que el tiempo de ejecución de Go termina el proceso con un desbordamiento de pila fatal (distinto de un pánico recuperable). Esta vulnerabilidad está corregida en la 0.23.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "ipld",
          "product": "go-ipld-prime",
          "versions": [
            {
              "version": "< 0.23.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 6.2,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-28T14:14:03.306469Z",
          "id": "CVE-2026-42328",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-674"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/ipld/go-ipld-prime/security/advisories/GHSA-w239-58x2-q8p5",
      "source": "[email protected]"
    }
  ]
}