CVE-2026-42328

Medium

Advisory

Published 7 May 2026In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.2; base score, highest
EPSS: 0.001; 2nd percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 26; of 17,781 indexed, latest versions
Container images: 25; deployed by those charts
Fix available: 1 of 1; affected package

go-ipld-prime's DAG-CBOR and DAG-JSON decoders have unbounded recursion depth

Carried by container images the latest versions of 26 of 17,781 indexed charts deploy, on 25 images.

Affected package	Affected versions	Fixed in	Images
github.com/ipld/go-ipld-primegolang	v0.5.1-0.20201021195245-109253e8a018, v0.9.0, v0.16.0, v0.19.0+2 more	0.23.0	25

OSV records: GHSA-w239-58x2-q8p5
Also known as: GO-2026-5684

Charts affected

26 by stars

Chart

Latest

Affected images

Radar Score

ipfs-clusterparadeum-team

0.0.19

2 of 2 See more

ipfs-cluster paradeum-team 0.0.19

2 of the 2 container images this version deploys carry CVE-2026-42328.

Container image	Digest	Package	Fixed in
ipfs/go-ipfs :v0.13.1	17259397f587	github.com/ipld/go-ipld-prime@v0.16.0	0.23.0
ipfs/ipfs-cluster :1.0.2	1511f6d57994	github.com/ipld/go-ipld-prime@v0.16.0	0.23.0

Open the chart page →

3,757

aramid-indexerbiatec-repo

3.9.0

1 of 5 See more

aramid-indexer biatec-repo 3.9.0

1 of the 5 container images this version deploys carry CVE-2026-42328.

Container image	Digest	Package	Fixed in
scholtz2/aramid-algo-follow-node :v4.3.0-stable	1ec63eca86b6	github.com/ipld/go-ipld-prime@v0.21.0	0.23.0

Open the chart page →

13,357

aramid-participationbiatec-repo

4.4.1

1 of 1 See more

aramid-participation biatec-repo 4.4.1

1 of the 1 container images this version deploys carry CVE-2026-42328.

Container image	Digest	Package	Fixed in
scholtz2/algorand-participation-aramidmain-extended :4.4.1-stable	f12ce1cfb72e	github.com/ipld/go-ipld-prime@v0.21.0	0.23.0

Open the chart page →

7,190

aramid-relaybiatec-repo

4.4.1

1 of 1 See more

aramid-relay biatec-repo 4.4.1

1 of the 1 container images this version deploys carry CVE-2026-42328.

Container image	Digest	Package	Fixed in
scholtz2/aramid-algo-node :v4.4.1-stable	70263d8fab5b	github.com/ipld/go-ipld-prime@v0.21.0	0.23.0

Open the chart page →

5,059

voimain-participationbiatec-repo

4.4.1

1 of 1 See more

voimain-participation biatec-repo 4.4.1

1 of the 1 container images this version deploys carry CVE-2026-42328.

Container image	Digest	Package	Fixed in
scholtz2/algorand-participation-voimain-extended :4.4.1-stable	64966de56d9f	github.com/ipld/go-ipld-prime@v0.21.0	0.23.0

Open the chart page →

7,190

celestia-nodecelestia-node

0.1.7

1 of 1 See more

celestia-node celestia-node 0.1.7

1 of the 1 container images this version deploys carry CVE-2026-42328.

Container image	Digest	Package	Fixed in
ghcr.io/celestiaorg/celestia-node :v0.16.0	41177982c584	github.com/ipld/go-ipld-prime@v0.21.0	0.23.0

Open the chart page →

1,799

spectrechronicle

0.3.8

1 of 1 See more

spectre chronicle 0.3.8

1 of the 1 container images this version deploys carry CVE-2026-42328.

Container image	Digest	Package	Fixed in
ghcr.io/chronicleprotocol/spectre :0.68.3	4e872bc016e8	github.com/ipld/go-ipld-prime@v0.21.0	0.23.0

Open the chart page →

1,515

beaconchain-explorerethereum-helm-charts

0.1.6

1 of 2 See more

beaconchain-explorer ethereum-helm-charts 0.1.6

1 of the 2 container images this version deploys carry CVE-2026-42328.

Container image	Digest	Package	Fixed in
gobitfly/eth2-beaconchain-explorer :latest	1d08a7986348	github.com/ipld/go-ipld-prime@v0.20.0	0.23.0

Open the chart page →

3,048

mcpmcp-charts

0.0.23

1 of 7 See more

mcp mcp-charts 0.0.23

1 of the 7 container images this version deploys carry CVE-2026-42328.

Container image	Digest	Package	Fixed in
ghcr.io/gla-rad/mc-mms-router :latest	032e977d9adf	github.com/ipld/go-ipld-prime@v0.21.0	0.23.0

Open the chart page →

6,929

graph-nodestakewise

3.1.0

1 of 3 See more

graph-node stakewise 3.1.0

1 of the 3 container images this version deploys carry CVE-2026-42328.

Container image	Digest	Package	Fixed in
ipfs/kubo :v0.24.0	e3de33bd746b	github.com/ipld/go-ipld-prime@v0.21.0	0.23.0

Open the chart page →

4,661

celestia-localastria

9.0.0

1 of 2 See more

celestia-local astria 9.0.0

1 of the 2 container images this version deploys carry CVE-2026-42328.

Container image	Digest	Package	Fixed in
ghcr.io/celestiaorg/celestia-node :v0.27.5-mocha	4768ea1c5fd2	github.com/ipld/go-ipld-prime@v0.21.0	0.23.0

Open the chart page →

3,281

celestia-nodeastria

0.7.1

1 of 1 See more

celestia-node astria 0.7.1

1 of the 1 container images this version deploys carry CVE-2026-42328.

Container image	Digest	Package	Fixed in
ghcr.io/celestiaorg/celestia-node :v0.27.5-mocha	4768ea1c5fd2	github.com/ipld/go-ipld-prime@v0.21.0	0.23.0

Open the chart page →

1,502

graph-nodeastria

0.2.2

1 of 3 See more

graph-node astria 0.2.2

1 of the 3 container images this version deploys carry CVE-2026-42328.

Container image	Digest	Package	Fixed in
ipfs/kubo :v0.17.0	803fac58ba15	github.com/ipld/go-ipld-prime@v0.19.0	0.23.0

Open the chart page →

5,495

bluesky-pdsbear

0.4.208

1 of 1 See more

bluesky-pds bear 0.4.208

1 of the 1 container images this version deploys carry CVE-2026-42328.

Container image	Digest	Package	Fixed in
ghcr.io/bluesky-social/pds :0.4.208	637083d9369d	github.com/ipld/go-ipld-prime@v0.21.0	0.23.0

Open the chart page →

2,136

algorand-participationbiatec-repo

4.4.1

1 of 1 See more

algorand-participation biatec-repo 4.4.1

1 of the 1 container images this version deploys carry CVE-2026-42328.

Container image	Digest	Package	Fixed in
scholtz2/algorand-participation-mainnet-extended :4.4.1-stable	5aaa5d4ab8b8	github.com/ipld/go-ipld-prime@v0.21.0	0.23.0

Open the chart page →

7,190

algorand-relaybiatec-repo

4.4.1

1 of 1 See more

algorand-relay biatec-repo 4.4.1

1 of the 1 container images this version deploys carry CVE-2026-42328.

Container image	Digest	Package	Fixed in
scholtz2/algorand-relay-mainnet :4.4.1-stable	e9af7d8ff6bb	github.com/ipld/go-ipld-prime@v0.21.0	0.23.0

Open the chart page →

5,059

mx-nodebicarus-labs

0.1.0

1 of 1 See more

mx-node bicarus-labs 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-42328.

Container image	Digest	Package	Fixed in
bicarus/elrond-rosetta :v1.3.50.0	b1dab0721e1c	github.com/ipld/go-ipld-prime@v0.9.0	0.23.0

Open the chart page →

7,956

spirechronicle

0.3.6

1 of 1 See more

spire chronicle 0.3.6

1 of the 1 container images this version deploys carry CVE-2026-42328.

Container image	Digest	Package	Fixed in
ghcr.io/chronicleprotocol/spire :0.68.3	79df4fb20322	github.com/ipld/go-ipld-prime@v0.21.0	0.23.0

Open the chart page →

1,515

matrix-media-repohalkeye

1.0.5

1 of 1 See more

matrix-media-repo halkeye 1.0.5

1 of the 1 container images this version deploys carry CVE-2026-42328.

Container image	Digest	Package	Fixed in
turt2live/matrix-media-repo :v1.2.8	bfbd459f89a5	github.com/ipld/go-ipld-prime@v0.5.1-0.20201021195245-109253e8a018	0.23.0

Open the chart page →

4,455

bluesky-pdsijmacd

1.0.0

1 of 2 See more

bluesky-pds ijmacd 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-42328.

Container image	Digest	Package	Fixed in
ghcr.io/bluesky-social/pds :0.4	d95725b24dbe	github.com/ipld/go-ipld-prime@v0.21.0	0.23.0

Open the chart page →

8,967

edgemeshkubesphere-stable

0.1.0

1 of 2 See more

edgemesh kubesphere-stable 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-42328.

Container image	Digest	Package	Fixed in
kubeedge/edgemesh-agent :latest	460c6061b608	github.com/ipld/go-ipld-prime@v0.9.0	0.23.0

Open the chart page →

4,096

bluesky-pdsnerkho-helm-charts

0.4.2

1 of 1 See more

bluesky-pds nerkho-helm-charts 0.4.2

1 of the 1 container images this version deploys carry CVE-2026-42328.

Container image	Digest	Package	Fixed in
ghcr.io/bluesky-social/pds :0.4.204	cbc6e3ea157d	github.com/ipld/go-ipld-prime@v0.21.0	0.23.0

Open the chart page →

2,383

spindlerubxkube

0.1.1

1 of 2 See more

spindle rubxkube 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-42328.

Container image	Digest	Package	Fixed in
ghcr.io/qjoly/spindle :v1.16.1-alpha	aab0c99d313f	github.com/ipld/go-ipld-prime@v0.21.0	0.23.0

Open the chart page →

1,438

ipfsstakewise

2.2.0

1 of 2 See more

ipfs stakewise 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-42328.

Container image	Digest	Package	Fixed in
ipfs/kubo :v0.33.2	1a30f5ed8579	github.com/ipld/go-ipld-prime@v0.21.0	0.23.0

Open the chart page →

1,239

ssv-nodestakewise

2.2.0

1 of 2 See more

ssv-node stakewise 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-42328.

Container image	Digest	Package	Fixed in
bloxstaking/ssv-node :v2.2.0	bf6d7d2fdc93	github.com/ipld/go-ipld-prime@v0.20.0	0.23.0

Open the chart page →

6,779

v3-backendstakewise

3.6.0

1 of 5 See more

v3-backend stakewise 3.6.0

1 of the 5 container images this version deploys carry CVE-2026-42328.

Container image	Digest	Package	Fixed in
ipfs/kubo :v0.33.2	1a30f5ed8579	github.com/ipld/go-ipld-prime@v0.21.0	0.23.0

Open the chart page →

1,239

Container images carrying it

25 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
ipfs/kubo :v0.33.2	1a30f5ed8579	github.com/ipld/go-ipld-prime@v0.21.0	0.23.0	2
ghcr.io/celestiaorg/celestia-node :v0.27.5-mocha	4768ea1c5fd2	github.com/ipld/go-ipld-prime@v0.21.0	0.23.0	2
bicarus/elrond-rosetta :v1.3.50.0	b1dab0721e1c	github.com/ipld/go-ipld-prime@v0.9.0	0.23.0	1
bloxstaking/ssv-node :v2.2.0	bf6d7d2fdc93	github.com/ipld/go-ipld-prime@v0.20.0	0.23.0	1
gobitfly/eth2-beaconchain-explorer :latest	1d08a7986348	github.com/ipld/go-ipld-prime@v0.20.0	0.23.0	1
ipfs/go-ipfs :v0.13.1	17259397f587	github.com/ipld/go-ipld-prime@v0.16.0	0.23.0	1
ipfs/ipfs-cluster :1.0.2	1511f6d57994	github.com/ipld/go-ipld-prime@v0.16.0	0.23.0	1
ipfs/kubo :v0.17.0	803fac58ba15	github.com/ipld/go-ipld-prime@v0.19.0	0.23.0	1
ipfs/kubo :v0.24.0	e3de33bd746b	github.com/ipld/go-ipld-prime@v0.21.0	0.23.0	1
kubeedge/edgemesh-agent :latest	460c6061b608	github.com/ipld/go-ipld-prime@v0.9.0	0.23.0	1
scholtz2/algorand-participation-aramidmain-extended :4.4.1-stable	f12ce1cfb72e	github.com/ipld/go-ipld-prime@v0.21.0	0.23.0	1
scholtz2/algorand-participation-mainnet-extended :4.4.1-stable	5aaa5d4ab8b8	github.com/ipld/go-ipld-prime@v0.21.0	0.23.0	1
scholtz2/algorand-participation-voimain-extended :4.4.1-stable	64966de56d9f	github.com/ipld/go-ipld-prime@v0.21.0	0.23.0	1
scholtz2/algorand-relay-mainnet :4.4.1-stable	e9af7d8ff6bb	github.com/ipld/go-ipld-prime@v0.21.0	0.23.0	1
scholtz2/aramid-algo-follow-node :v4.3.0-stable	1ec63eca86b6	github.com/ipld/go-ipld-prime@v0.21.0	0.23.0	1
scholtz2/aramid-algo-node :v4.4.1-stable	70263d8fab5b	github.com/ipld/go-ipld-prime@v0.21.0	0.23.0	1
turt2live/matrix-media-repo :v1.2.8	bfbd459f89a5	github.com/ipld/go-ipld-prime@v0.5.1-0.20201021195245-109253e8a018	0.23.0	1
ghcr.io/bluesky-social/pds :0.4.208	637083d9369d	github.com/ipld/go-ipld-prime@v0.21.0	0.23.0	1
ghcr.io/bluesky-social/pds :0.4.204	cbc6e3ea157d	github.com/ipld/go-ipld-prime@v0.21.0	0.23.0	1
ghcr.io/bluesky-social/pds :0.4	d95725b24dbe	github.com/ipld/go-ipld-prime@v0.21.0	0.23.0	1
ghcr.io/celestiaorg/celestia-node :v0.16.0	41177982c584	github.com/ipld/go-ipld-prime@v0.21.0	0.23.0	1
ghcr.io/chronicleprotocol/spectre :0.68.3	4e872bc016e8	github.com/ipld/go-ipld-prime@v0.21.0	0.23.0	1
ghcr.io/chronicleprotocol/spire :0.68.3	79df4fb20322	github.com/ipld/go-ipld-prime@v0.21.0	0.23.0	1
ghcr.io/gla-rad/mc-mms-router :latest	032e977d9adf	github.com/ipld/go-ipld-prime@v0.21.0	0.23.0	1
ghcr.io/qjoly/spindle :v1.16.1-alpha	aab0c99d313f	github.com/ipld/go-ipld-prime@v0.21.0	0.23.0	1