Is CVE-2026-42328 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42328 being exploited in the wild.

How severe is CVE-2026-42328?

Medium severity, with a CVSS score of 6.2, published 27 May 2026.

Which products and versions are affected?

github.com/ipld/go-ipld-prime (Go) < 0.23.0, SEMVER:introduced=0,fixed=0.23.0; IPLD Go-Ipld-Prime < 0.23.0.

Is there a fix for CVE-2026-42328?

Yes. github.com/ipld/go-ipld-prime (Go): upgrade to 0.23.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42328 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-42328?

Check whether you run github.com/ipld/go-ipld-prime (Go) or IPLD Go-Ipld-Prime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42328: IPLD go-ipld-prime uncontrolled recursion in DAG-CBOR and DAG-JSON decoders

Q: Is there a fix for CVE-2026-42328?

Yes. github.com/ipld/go-ipld-prime (Go): upgrade to 0.23.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-42328 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2026-42328?

Check whether you run github.com/ipld/go-ipld-prime (Go) or IPLD Go-Ipld-Prime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42328 · Severity: medium · CVSS 6.2 · Published 2026-05-27

A vulnerability in the go-ipld-prime library, which is used for handling InterPlanetary Linked Data (IPLD), can allow an attacker to crash an application. By providing a specially crafted, deeply nested data file, an attacker can cause the software to exhaust its memory and stop functioning. This results in a denial-of-service, potentially disrupting services that rely on this library to process data.

Technologies: github.com/ipld/go-ipld-prime (Go). Vendors: Go.

Quick answers

Is CVE-2026-42328 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42328 being exploited in the wild.
How severe is CVE-2026-42328?: Medium severity, with a CVSS score of 6.2, published 27 May 2026.
Which products and versions are affected?: github.com/ipld/go-ipld-prime (Go) < 0.23.0, SEMVER:introduced=0,fixed=0.23.0; IPLD Go-Ipld-Prime < 0.23.0.
Is there a fix for CVE-2026-42328?: Yes. github.com/ipld/go-ipld-prime (Go): upgrade to 0.23.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42328 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-42328?: Check whether you run github.com/ipld/go-ipld-prime (Go) or IPLD Go-Ipld-Prime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/ipld/go-ipld-prime (Go): upgrade to 0.23.0 or later
```
go get github.com/ipld/go-ipld-prime@v0.23.0
```

Technical details

The DAG-CBOR and DAG-JSON decoders in go-ipld-prime prior to version 0.23.0 fail to implement a recursion depth limit when processing nested maps or lists. An attacker can provide a small payload (e.g., 2 MB) containing deeply nested collections that exhausts the Go goroutine stack, leading to a fatal stack overflow that cannot be recovered via standard panics. This occurs because the existing allocation budget system does not account for the stack cost of recursive calls. The vulnerability is present in schema-free decoding and schema-bound decoding where schemas contain recursive references or 'Any' types. A fix is available in version 0.23.0 which introduces a configurable MaxDepth option defaulting to 1024.

Affected products

ipld go-ipld-prime < 0.23.0

Identifiers

CVE-2026-42328
GHSA-w239-58x2-q8p5
GO-2026-5684

Timeline

2026-05-07: advisory: GitHub Advisory published
2026-05-07: patched: First patched version 0.23.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.