https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 07:38:29 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-228827 EUVD-2026-228827 https://cve.radiocsirt.org/vuln/euvd-2026-228827 https://cve.radiocsirt.org/vuln/fkie_cve-2022-2584 <p>The dag-pb codec can panic when decoding invalid blocks.</p> <p>The dag-pb codec can panic when decoding invalid blocks.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-2584 https://cve.radiocsirt.org/vuln/ghsa-g3vv-g2j5-45f2 <p><strong>Affected:</strong> Go: github.com/ipld/go-codec-dagpb</p> <p>### Impact Decoding certain blocks using the go-ipld-prime version of the dag-pb codec (go-codec-dagpb) can cause a panic. The panic comes from an assumption that the reported link length is accurate, but if the block ends before that reported length then it’s a buffer overread.</p> <p>### Patches The issue is fixed in v1.3.1 and above.</p> <p>Consumers can discover the versions of `go-codec-dagpb` in a module&#39;s dependency graph using the following command in the module root:</p> <p>```go mod graph | grep go-codec-dagpb```</p> <p>### Workarounds You can work around this issue without upgrading by recovering panics higher in the call stack of the goroutine that calls the defective code.</p> <p>### For more information If you have any questions or comments about this advisory:</p> <p>* Ask in [IPFS Discord #ipld-chatter](https://discord.gg/ipfs) * Open an issue in [go-codec-dagpb](https://github.com/ipld/go-codec-dagpb)</p> <p><strong>Affected:</strong> Go: github.com/ipld/go-codec-dagpb</p> <p>### Impact Decoding certain blocks using the go-ipld-prime version of the dag-pb codec (go-codec-dagpb) can cause a panic. The panic comes from an assumption that the reported link length is accurate, but if the block ends before that reported length then it’s a buffer overread.</p> <p>### Patches The issue is fixed in v1.3.1 and above.</p> <p>Consumers can discover the versions of `go-codec-dagpb` in a module&#39;s dependency graph using the following command in the module root:</p> <p>```go mod graph | grep go-codec-dagpb```</p> <p>### Workarounds You can work around this issue without upgrading by recovering panics higher in the call stack of the goroutine that calls the defective code.</p> <p>### For more information If you have any questions or comments about this advisory:</p> <p>* Ask in [IPFS Discord #ipld-chatter](https://discord.gg/ipfs) * Open an issue in [go-codec-dagpb](https://github.com/ipld/go-codec-dagpb)</p> https://cve.radiocsirt.org/vuln/ghsa-g3vv-g2j5-45f2 https://cve.radiocsirt.org/vuln/gsd-2022-2584 gsd-2022-2584 https://cve.radiocsirt.org/vuln/gsd-2022-2584