{"id":"CVE-2022-2584","aliases":["EUVD-2022-7573","GHSA-967g-cjx4-h7j6","GHSA-g3vv-g2j5-45f2","GO-2022-0422"],"status":"published","title":"Panic when decoding invalid blocks in github.com/ipld/go-codec-dagpb","description":"The dag-pb codec can panic when decoding invalid blocks.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00771,"percentile":0.56089,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2022-04-08T22:08:45Z","modified":"2026-10-28T02:30:35Z","fixes":[{"ecosystem":"Go","package":"github.com/ipld/go-codec-dagpb","fixed_in":["1.3.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/ipld/go-codec-dagpb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/ipld/go-codec-dagpb","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.3.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/ipld/go-codec-dagpb","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.3.1"}]}]}],"products":[{"vendor":"github.com/ipld/go-codec-dagpb","product":"github.com/ipld/go-codec-dagpb"},{"vendor":"protocol","product":"go-codec-dagpb"}],"references":[{"url":"https://github.com/ipld/go-codec-dagpb/commit/a17ace35cc760a2698645c09868f9050fa219f57","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://pkg.go.dev/vuln/GO-2022-0422","tags":["x_transferred","Patch","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2584","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-967g-cjx4-h7j6"},{"url":"https://github.com/ipld/go-codec-dagpb/security/advisories/GHSA-g3vv-g2j5-45f2","tags":["web"]},{"url":"https://github.com/advisories/GHSA-g3vv-g2j5-45f2"},{"url":"https://pkg.go.dev","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/2xxx/CVE-2022-2584.json","tags":["advisory"]},{"url":"github.com/ipld/go-codec-dagpb","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-2584","title":"Panic when decoding invalid blocks in github.com/ipld/go-codec-dagpb","description":"The dag-pb codec can panic when decoding invalid blocks.","status":"published","published":"2022-12-27T21:13:51.963Z","modified":"2025-04-11T16:41:55.24Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"updated_at":"2026-11-02T14:34:32.495407Z"}],"euvd":[{"id":"EUVD-2022-7573","description":"The dag-pb codec can panic when decoding invalid blocks.","status":"published","published":"2022-12-27T21:13:51Z","modified":"2025-04-11T16:41:55Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:34.493984Z"}],"ghsa":[{"id":"GHSA-967g-cjx4-h7j6","title":"Duplicate Advisory: go-codec-dagpb vulnerable to panic when decoding invalid blocks","description":"## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-g3vv-g2j5-45f2. This link is maintained to preserve external references.\n\n## Original Description\ngo-codec-dagpb is an implementation of the DAG-PB spec for Go. The dag-pb codec can panic when decoding invalid blocks. This issue has been patched in version 1.3.1.","status":"withdrawn","published":"2022-12-28T00:30:23Z","modified":"2026-01-23T22:34:01Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:39:19.525691Z"},{"id":"GHSA-g3vv-g2j5-45f2","title":"ipld/go-codec-dagpb panics when processing certain blocks","description":"### Impact \nDecoding certain blocks using the go-ipld-prime version of the dag-pb codec (go-codec-dagpb) can cause a panic.  The panic comes from an assumption that the reported link length is accurate, but if the block ends before that reported length then it’s a buffer overread.\n\n### Patches\nThe issue is fixed in v1.3.1 and above.\n\nConsumers can discover the versions of `go-codec-dagpb` in a module's dependency graph using the following command in the module root:\n\n```go mod graph | grep go-codec-dagpb```\n\n### Workarounds\nYou can work around this issue without upgrading by recovering panics higher in the call stack of the goroutine that calls the defective code.\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n* Ask in [IPFS Discord #ipld-chatter](https://discord.gg/ipfs)\n* Open an issue in [go-codec-dagpb](https://github.com/ipld/go-codec-dagpb)","status":"published","published":"2022-04-08T22:08:45Z","modified":"2026-01-23T22:34:06Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:39:19.525691Z"}],"nvd":[{"id":"CVE-2022-2584","description":"The dag-pb codec can panic when decoding invalid blocks.","status":"published","published":"2022-12-27T22:15:12.653Z","modified":"2026-06-17T04:42:09.723Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:07:34.388163Z"}],"osv":[{"id":"CVE-2022-2584","title":"Panic when decoding invalid blocks in github.com/ipld/go-codec-dagpb","description":"The dag-pb codec can panic when decoding invalid blocks.","status":"published","published":"2022-12-27T21:13:51.963Z","modified":"2026-10-28T02:30:35.896541372Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:24.758293Z"},{"id":"GHSA-967g-cjx4-h7j6","title":"Duplicate Advisory: go-codec-dagpb vulnerable to panic when decoding invalid blocks","description":"## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-g3vv-g2j5-45f2. This link is maintained to preserve external references.\n\n## Original Description\ngo-codec-dagpb is an implementation of the DAG-PB spec for Go. The dag-pb codec can panic when decoding invalid blocks. This issue has been patched in version 1.3.1.","status":"withdrawn","published":"2022-12-28T00:30:23Z","modified":"2026-02-03T03:08:19.655547Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T15:46:43.123867Z"},{"id":"GHSA-g3vv-g2j5-45f2","title":"ipld/go-codec-dagpb panics when processing certain blocks","description":"### Impact \nDecoding certain blocks using the go-ipld-prime version of the dag-pb codec (go-codec-dagpb) can cause a panic.  The panic comes from an assumption that the reported link length is accurate, but if the block ends before that reported length then it’s a buffer overread.\n\n### Patches\nThe issue is fixed in v1.3.1 and above.\n\nConsumers can discover the versions of `go-codec-dagpb` in a module's dependency graph using the following command in the module root:\n\n```go mod graph | grep go-codec-dagpb```\n\n### Workarounds\nYou can work around this issue without upgrading by recovering panics higher in the call stack of the goroutine that calls the defective code.\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n* Ask in [IPFS Discord #ipld-chatter](https://discord.gg/ipfs)\n* Open an issue in [go-codec-dagpb](https://github.com/ipld/go-codec-dagpb)","status":"published","published":"2022-04-08T22:08:45Z","modified":"2026-02-03T03:08:22.859511Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T15:46:47.119724Z"},{"id":"GO-2022-0422","title":"Panic when decoding invalid blocks in github.com/ipld/go-codec-dagpb","description":"The dag-pb codec can panic when decoding invalid blocks.","status":"published","published":"2022-07-01T20:08:04Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:00.918515Z"}]}}