https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T07:38:37.849512+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-228827 EUVD-2026-228827 2026-10-03T07:38:37.852264+00:00 EUVD-2026-228827 https://cve.radiocsirt.org/vuln/fkie_cve-2022-2584 fkie_cve-2022-2584 2026-10-03T07:38:37.852297+00:00

The dag-pb codec can panic when decoding invalid blocks.

 https://cve.radiocsirt.org/vuln/ghsa-g3vv-g2j5-45f2 GHSA-g3vv-g2j5-45f2 — ipld/go-codec-dagpb panics when processing certain blocks 2026-10-03T07:38:37.852326+00:00

Affected: Go: github.com/ipld/go-codec-dagpb

### Impact Decoding certain blocks using the go-ipld-prime version of the dag-pb codec (go-codec-dagpb) can cause a panic. The panic comes from an assumption that the reported link length is accurate, but if the block ends before that reported length then it’s a buffer overread.

### Patches The issue is fixed in v1.3.1 and above.

Consumers can discover the versions of `go-codec-dagpb` in a module's dependency graph using the following command in the module root:

```go mod graph | grep go-codec-dagpb```

### Workarounds You can work around this issue without upgrading by recovering panics higher in the call stack of the goroutine that calls the defective code.

### For more information If you have any questions or comments about this advisory:

* Ask in [IPFS Discord #ipld-chatter](https://discord.gg/ipfs) * Open an issue in [go-codec-dagpb](https://github.com/ipld/go-codec-dagpb)

 https://cve.radiocsirt.org/vuln/gsd-2022-2584 gsd-2022-2584 2026-10-03T07:38:37.852364+00:00 gsd-2022-2584