The go-ipld-prime library, implementing IPLD interfaces and codecs for CBOR and JSON, had a vulnerability in its DAG-CBOR decoder before version 0.22.0. The decoder used collection sizes declared in CBOR headers as preallocation hints for maps and lists but did not cap these size hints or consider their memory cost. This allowed crafted small payloads to trigger excessive memory allocation, potentially leading to denial of service due to resource exhaustion. The issue is addressed by limiting or properly handling these size hints starting from version 0.22.0.

An attacker can cause excessive memory allocation by sending small but specially crafted CBOR payloads, leading to denial of service conditions due to resource exhaustion. There is no impact on confidentiality or integrity. The CVSS score is 6.2 (medium severity) with an attack vector limited to local access, low complexity, no privileges required, no user interaction, and impact limited to availability.

Upgrade go-ipld-prime to version 0.22.0 or later where this vulnerability is fixed. Since no official patch link or vendor advisory is provided, verify the upgrade from the official ipld project sources. Until upgraded, avoid processing untrusted CBOR payloads with vulnerable versions to reduce risk.