Executive brief
A vulnerability in the go-ipld-prime library, which is used for handling InterPlanetary Linked Data (IPLD), can allow an attacker to crash an application. By providing a specially crafted, deeply nested data file, an attacker can cause the software to exhaust its memory and stop functioning. This results in a denial-of-service, potentially disrupting services that rely on this library to process data.
Technical details
The DAG-CBOR and DAG-JSON decoders in go-ipld-prime prior to version 0.23.0 fail to implement a recursion depth limit when processing nested maps or lists. An attacker can provide a small payload (e.g., 2 MB) containing deeply nested collections that exhausts the Go goroutine stack, leading to a fatal stack overflow that cannot be recovered via standard panics. This occurs because the existing allocation budget system does not account for the stack cost of recursive calls. The vulnerability is present in schema-free decoding and schema-bound decoding where schemas contain recursive references or 'Any' types. A fix is available in version 0.23.0 which introduces a configurable MaxDepth option defaulting to 1024.
Affected products
- ipld go-ipld-prime < 0.23.0
Timeline
- 2026-05-07: advisory: GitHub Advisory published
- 2026-05-07: patched: First patched version 0.23.0 released