CVE-2026-42328: go-ipld-prime Buffer Overflow Vulnerability

CVE-2026-42328 Overview

CVE-2026-42328 affects go-ipld-prime, a Go implementation of the InterPlanetary Linked Data (IPLD) specification. The library provides codec implementations for DAG-CBOR and DAG-JSON along with tooling for IPLD object operations. Versions prior to 0.23.0 decode nested maps and lists through unbounded recursion. A crafted payload with deeply nested collections forces the decoder to recurse once per level, expanding the goroutine stack until the Go runtime terminates the process with a fatal stack overflow. The fatal stack overflow is distinct from a recoverable panic, so applications cannot trap or contain the crash. The flaw is tracked under CWE-674: Uncontrolled Recursion and is fixed in version 0.23.0.

Critical Impact
A single malformed IPLD payload can terminate any Go process that decodes untrusted DAG-CBOR or DAG-JSON input, producing a denial-of-service condition that cannot be caught by recover().

Affected Products

go-ipld-prime versions prior to 0.23.0
Applications embedding the DAG-CBOR decoder from go-ipld-prime
Applications embedding the DAG-JSON decoder from go-ipld-prime

Discovery Timeline

2026-05-27 - CVE-2026-42328 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-42328

Vulnerability Analysis

The go-ipld-prime library implements decoders for two IPLD codecs: DAG-CBOR (a deterministic Concise Binary Object Representation profile) and DAG-JSON. Both decoders walk incoming data structures using direct function recursion. Each nested map or list triggers another decoder frame on the goroutine stack.

Go goroutine stacks grow dynamically, but the runtime enforces a hard maximum. When the cumulative stack frames exceed this ceiling, the runtime raises a fatal stack overflow and terminates the entire process. Unlike a panic, a fatal stack overflow bypasses defer and recover() handlers, so wrapping the decoder in protective code does not contain the crash.

An attacker who can submit IPLD-encoded data to a vulnerable application can craft a payload of arbitrarily nested arrays or maps. Decoding the payload exhausts the stack and kills the process. The condition affects services that ingest IPLD content from peers, files, or storage backends.

Root Cause

The decoders lack a depth counter or recursion limit. Each call to the nested decode routine adds a stack frame without checking how many parent collections have already been opened. The CWE-674 classification captures this absence of recursion bounds.

Attack Vector

The CVSS vector indicates a local attack vector, no privileges, and no user interaction, with impact limited to availability. Exploitation requires the attacker to deliver a malicious IPLD blob to a process that calls the vulnerable decoder. In environments where the host application accepts IPLD payloads over a network channel, the practical reach extends beyond a strictly local boundary because the decoder still consumes attacker-controlled bytes.

The vulnerability does not expose memory contents and does not permit code execution. The realized impact is unconditional process termination.

Detection Methods for CVE-2026-42328

Indicators of Compromise

Sudden process exits accompanied by runtime: goroutine stack exceeds messages in stderr or container logs.
Repeated restarts of services that parse DAG-CBOR or DAG-JSON inputs without preceding panic stack traces.
Inbound IPLD payloads with collection nesting depths far exceeding application norms.

Detection Strategies

Inventory Go binaries and modules for dependencies on github.com/ipld/go-ipld-prime at versions below 0.23.0 using go list -m all or software composition analysis.
Add structural validation at ingress that rejects IPLD payloads exceeding a documented maximum nesting depth before they reach the decoder.
Instrument decoder call sites with metrics tracking input size and decode duration to surface anomalous inputs.

Monitoring Recommendations

Forward container and host logs containing fatal error: stack overflow to a central log platform and alert on occurrence.
Track process restart rates for services that ingest IPLD data and correlate with upstream payload sources.
Capture sample payloads that trigger crashes for offline structural analysis.

How to Mitigate CVE-2026-42328

Immediate Actions Required

Upgrade github.com/ipld/go-ipld-prime to version 0.23.0 or later in all affected Go modules and rebuild dependent binaries.
Audit transitive dependencies, because IPFS and related libraries frequently pull go-ipld-prime indirectly.
Restrict acceptance of IPLD payloads from untrusted sources until the upgrade is deployed.

Patch Information

The maintainers fixed the issue in go-ipld-prime0.23.0 by adding depth-limited decoding paths for DAG-CBOR and DAG-JSON. Full details are available in the GitHub Security Advisory GHSA-w239-58x2-q8p5.

Workarounds

Place a size and structural validator in front of the decoder that rejects payloads exceeding a conservative depth threshold.
Isolate IPLD decoding into a sacrificial worker process so a stack overflow does not terminate the primary service.
Rate-limit and authenticate IPLD payload submission paths to reduce exposure to anonymous attackers.

bash

# Upgrade go-ipld-prime to the patched release
go get github.com/ipld/go-ipld-prime@v0.23.0
go mod tidy
go build ./...

# Verify the resolved version
go list -m github.com/ipld/go-ipld-prime