Duplicate Advisory: go-codec-dagpb vulnerable to panic when decoding invalid blocks

HIGH 7.5CVE-2022-2584 · GHSA-967g-cjx4-h7j6 · GHSA-g3vv-g2j5-45f2 · Published 27/12/2022 · updated 17/06/2026

In short

CVE-2022-2584 is a HIGH (CVSS 7.5) vulnerability affecting github.com/ipld/go-codec-dagpb, go-codec-dagpb (protocol).
Chance of exploitation in the next 30 days (EPSS): 0.77%, higher than 55.7% of all vulnerabilities.
Fix: update to 1.3.1 or later.

Package	Affected versions	Patched versions
github.com/ipld/go-codec-dagpb Go	`< 1.3.1`	`1.3.1`
go-codec-dagpb protocol	`< 1.3.1`	`1.3.1`

Description

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-g3vv-g2j5-45f2. This link is maintained to preserve external references.

Original Description

go-codec-dagpb is an implementation of the DAG-PB spec for Go. The dag-pb codec can panic when decoding invalid blocks. This issue has been patched in version 1.3.1.

NVD description

The dag-pb codec can panic when decoding invalid blocks.

References

nvd.nist.gov/vuln/detail/CVE-2022-2584 · ADVISORY
ipld/go-codec-dagpb commit a17ace3 · WEB
pkg.go.dev/vuln/GO-2022-0422 · WEB
github.com/ipld/go-codec-dagpb · PACKAGE
ipld/go-codec-dagpb security advisory · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free