GHSA-967g-cjx4-h7j6: Duplicate Advisory: go-codec-dagpb vulnerable to panic when decoding invalid blocks

December 28, 2022 (updated January 23, 2026)

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-g3vv-g2j5-45f2. This link is maintained to preserve external references.

Original Description

go-codec-dagpb is an implementation of the DAG-PB spec for Go. The dag-pb codec can panic when decoding invalid blocks. This issue has been patched in version 1.3.1.

References

github.com/advisories/GHSA-967g-cjx4-h7j6
github.com/ipld/go-codec-dagpb/commit/a17ace35cc760a2698645c09868f9050fa219f57
nvd.nist.gov/vuln/detail/CVE-2022-2584
pkg.go.dev/vuln/GO-2022-0422

Code Behaviors & Features

Detect and mitigate GHSA-967g-cjx4-h7j6 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →