CVE-2022-2584: ipld/go-codec-dagpb panics when processing certain blocks

April 8, 2022 (updated January 23, 2026)

Decoding certain blocks using the go-ipld-prime version of the dag-pb codec (go-codec-dagpb) can cause a panic. The panic comes from an assumption that the reported link length is accurate, but if the block ends before that reported length then it’s a buffer overread.

References

github.com/advisories/GHSA-g3vv-g2j5-45f2
github.com/ipld/go-codec-dagpb/commit/a17ace35cc760a2698645c09868f9050fa219f57
github.com/ipld/go-codec-dagpb/security/advisories/GHSA-g3vv-g2j5-45f2
nvd.nist.gov/vuln/detail/CVE-2022-2584
pkg.go.dev/vuln/GO-2022-0422

Code Behaviors & Features

Detect and mitigate CVE-2022-2584 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →