6.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-42328

CVE-2026-42328: go-ipld-prime: DAG-CBOR and DAG-JSON decoders unbounded recursion depth

go-ipld-prime is an implementation of the InterPlanetary Linked Data (IPLD) spec interfaces, a batteries-included codec implementations of IPLD for CBOR and JSON, and tooling for basic operations on IPLD objects. Prior to 0.23.0, the DAG-CBOR and DAG-JSON decoders recurse on each nested map or list without a depth limit. A payload containing deeply nested collections causes the decoder to recurse once per level, growing the goroutine stack until the Go runtime terminates the process with a fatal stack overflow (distinct from a recoverable panic). This vulnerability is fixed in 0.23.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-42328

CVE-2026-42328:

6.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/ipld/go-ipld-prime	go	< 0.23.0	0.23.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an uncontrolled recursion in the DAG-CBOR and DAG-JSON decoders in go-ipld-prime. A malicious actor can craft a deeply nested payload which causes the decoder to recurse until the stack is exhausted, leading to a denial of service. The patch introduces a MaxDepth option in the decoders to limit the recursion depth. The vulnerable functions are the recursive decoding functions in codec/dagcbor/decode.go and codec/dagjson/decode.go. These functions, named decode, are responsible for parsing the input and recursively calling themselves to handle nested data structures. Before the patch, these functions lacked a depth check, making them vulnerable. The identified functions are the ones that would appear in a stack trace during the exploitation of this vulnerability.

Vulnerable functions

github.com/ipld/go-ipld-prime/codec/dagcbor.decoder.decode

codec/dagcbor/decode.go

This function is the core of the DAG-CBOR decoder. It recursively decodes nested data structures. Without a depth limit, a malicious input with deeply nested structures could cause a stack overflow.

github.com/ipld/go-ipld-prime/codec/dagjson.decoder.decode

codec/dagjson/decode.go

This function is the core of the DAG-JSON decoder. It recursively decodes nested data structures. Without a depth limit, a malicious input with deeply nested structures could cause a stack overflow.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.