CVE-2026-35480

OVERVIEW: CVE-2026-35480 affects go-ipld-prime, an implementation of the InterPlanetary Linked Data specification used for CBOR and JSON codec operations. Prior to version 0.22.0, the DAG-CBOR decoder improperly handles collection size declarations in CBOR headers by using them as preallocation hints without implementing caps or allocation budgets. This design flaw allows attackers to craft small CBOR payloads that trigger excessive memory allocation on target systems. SEVERITY: The vulnerability is classified as MEDIUM severity with a CVSS v3.1 score of 6.2. The attack vector is local with low complexity and requires no privileges or user interaction. The impact is limited to availability disruption, as the flaw causes denial of service through memory exhaustion rather than compromising confidentiality or integrity. The EPSS score of 0.00017 indicates low probability of exploitation relative to other CVEs. EXPLOITATION STATUS: There is no evidence of active exploitation in the wild. The CVE is not listed on CISA's Known Exploited Vulnerabilities catalog and remains inactive on vulnerability tracking lists. No public exploit code has been reported, and community attention is minimal. Organizations using go-ipld-prime should update to version 0.22.0 or later as a precautionary measure.