{"schemaVersion":3,"id":"CVE-2026-35480","aliases":["CGA-24vm-99hx-374m","CGA-2f8c-cfh7-qvh9","CGA-38w3-wwhp-xr77","CGA-3hq4-v932-7f26","CGA-4x5c-xx8j-8hxq","CGA-586w-865x-fqxv","CGA-5899-34qv-whpx","CGA-66p3-vv86-qvh6","CGA-673h-6959-gq8p","CGA-6f8h-fx78-6qhh","CGA-7632-q6vj-x4hg","CGA-7gq6-j84j-7hq9","CGA-8rwm-6cm3-q4f6","CGA-8xff-7h3r-96xh","CGA-8xgw-wvmm-h65r","CGA-9xqg-v2mj-264x","CGA-fm95-cjm4-w224","CGA-g2fq-ph3p-vv2c","CGA-jhgw-c6c7-7959","CGA-m7v8-57mm-q53g","CGA-ppmf-7phh-42hx","CGA-q3qm-2m2c-5752","CGA-q4v3-28hc-r9fj","CGA-qfjq-gr2p-2prh","CGA-x4w3-jj99-xvvx","GHSA-378j-3jfj-8r9f","GO-2026-5073","CGA-23xm-5wm3-qjg5","CGA-2pvr-7g7q-vgfx","CGA-3wf8-m95w-ccxv","CGA-3wfq-pv86-3832","CGA-4wqg-wh84-xvrf","CGA-6vj3-pcr2-m8cc","CGA-898j-x76r-9pqp","CGA-8rv8-j99f-j735","CGA-cjjj-774g-w9c6","CGA-f4p7-x2rr-wxph","CGA-f7vm-x37x-3rch","CGA-hq52-66p6-5rgc","CGA-j2j8-jc2p-x6jp","CGA-jmmx-wm2w-9xxp","CGA-jpq8-3577-gh3m","CGA-jq95-5wv9-5qj2","CGA-m9q3-c2m3-xc4m","CGA-p4f4-gqjg-ph2c","CGA-pgf5-fjgc-p655","CGA-qxcr-wg6x-c59h","CGA-r4j8-2w8q-q359","CGA-rffm-jqhq-r25m","CGA-rhfx-56w3-2h8j","CGA-rjph-jcmh-6jfx","CGA-vf43-wrwx-x7rx","CGA-vfmc-h7p9-857g","CGA-wj8r-h84g-43pf","CGA-xgmv-xrw7-xr4w","CGA-xmwv-m8r8-3mj7","CGA-xrvf-4hpj-wp2r"],"status":"published","duplicateOf":null,"title":null,"description":"go-ipld-prime is an implementation of the InterPlanetary Linked Data (IPLD) spec interfaces, a batteries-included codec implementations of IPLD for CBOR and JSON, and tooling for basic operations on IPLD objects. Prior to 0.22.0, the DAG-CBOR decoder uses collection sizes declared in CBOR headers as Go preallocation hints for maps and lists. The decoder does not cap these size hints or account for their cost in its allocation budget, allowing small payloads to cause excessive memory allocation. This vulnerability is fixed in 0.22.0.","dates":{"published":"2026-04-07T14:43:24.781Z","modified":"2026-04-09T14:40:11.103Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.2,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":6.2,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Wolfi","score":6.2,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":6.4,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Go","score":6.2,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":6.4,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":6.2,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":6.4,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":6.2,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00157,"percentile":0.04472,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0.0010000000000000026,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.00156},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00156,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00156,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00156,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00156,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00156,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00156,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00156,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00156,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00156,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00156,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00157,"percentile":0.04472}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.00156,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00156,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00156,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00156,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00157,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00157,"percentile":0.04472}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-770","name":"Allocation of Resources Without Limits or Throttling","description":"The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/770.html"}],"affected":[{"vendor":"chainguard","product":"ipfs-cluster","name":"ipfs-cluster","label":"ipfs-cluster","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/ipfs-cluster","purlType":"apk","versions":[{"text":"< 1.1.5-r11","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.1.5-r11","eol":null,"hubHref":null},{"vendor":"chainguard","product":"ipfs-cluster-fips","name":"ipfs-cluster-fips","label":"ipfs-cluster-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/ipfs-cluster-fips","purlType":"apk","versions":[{"text":"< 1.1.5-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.1.5-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"k3s","name":"k3s","label":"k3s","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/k3s","purlType":"apk","versions":[{"text":"< 1.35.3.1-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.35.3.1-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"k3s-1.31","name":"k3s-1.31","label":"k3s-1.31","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/k3s-1.31","purlType":"apk","versions":[{"text":"< 1.31.6.1-r22","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.31.6.1-r22","eol":null,"hubHref":null},{"vendor":"chainguard","product":"k3s-1.32","name":"k3s-1.32","label":"k3s-1.32","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/k3s-1.32","purlType":"apk","versions":[{"text":"< 1.32.13.1-r10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.32.13.1-r10","eol":null,"hubHref":null},{"vendor":"chainguard","product":"k3s-1.33","name":"k3s-1.33","label":"k3s-1.33","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/k3s-1.33","purlType":"apk","versions":[{"text":"< 1.33.10.1-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.33.10.1-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"k3s-1.34","name":"k3s-1.34","label":"k3s-1.34","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/k3s-1.34","purlType":"apk","versions":[{"text":"< 1.34.6.1-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.34.6.1-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"k3s-1.35","name":"k3s-1.35","label":"k3s-1.35","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/k3s-1.35","purlType":"apk","versions":[{"text":"< 1.35.3.1-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.35.3.1-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"k3s-static","name":"k3s-static","label":"k3s-static","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/k3s-static","purlType":"apk","versions":[{"text":"< 1.35.3.1-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.35.3.1-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"k3s-static-1.31","name":"k3s-static-1.31","label":"k3s-static-1.31","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/k3s-static-1.31","purlType":"apk","versions":[{"text":"< 1.31.6.1-r22","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.31.6.1-r22","eol":null,"hubHref":null},{"vendor":"chainguard","product":"k3s-static-1.32","name":"k3s-static-1.32","label":"k3s-static-1.32","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/k3s-static-1.32","purlType":"apk","versions":[{"text":"< 1.32.13.1-r10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.32.13.1-r10","eol":null,"hubHref":null},{"vendor":"chainguard","product":"k3s-static-1.33","name":"k3s-static-1.33","label":"k3s-static-1.33","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/k3s-static-1.33","purlType":"apk","versions":[{"text":"< 1.33.10.1-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.33.10.1-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"k3s-static-1.34","name":"k3s-static-1.34","label":"k3s-static-1.34","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/k3s-static-1.34","purlType":"apk","versions":[{"text":"< 1.34.6.1-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.34.6.1-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"k3s-static-1.35","name":"k3s-static-1.35","label":"k3s-static-1.35","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/k3s-static-1.35","purlType":"apk","versions":[{"text":"< 1.35.3.1-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.35.3.1-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"rke2-runtime-1.31","name":"rke2-runtime-1.31","label":"rke2-runtime-1.31","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/rke2-runtime-1.31","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"rke2-runtime-1.32","name":"rke2-runtime-1.32","label":"rke2-runtime-1.32","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/rke2-runtime-1.32","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"rke2-runtime-1.33","name":"rke2-runtime-1.33","label":"rke2-runtime-1.33","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/rke2-runtime-1.33","purlType":"apk","versions":[{"text":"< 1.33.10.2.2-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.33.10.2.2-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"rke2-runtime-1.34","name":"rke2-runtime-1.34","label":"rke2-runtime-1.34","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/rke2-runtime-1.34","purlType":"apk","versions":[{"text":"< 1.34.6.2.3-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.34.6.2.3-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"rke2-runtime-1.35","name":"rke2-runtime-1.35","label":"rke2-runtime-1.35","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/rke2-runtime-1.35","purlType":"apk","versions":[{"text":"< 1.35.3.2.3-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.35.3.2.3-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"rke2-runtime-fips-1.31","name":"rke2-runtime-fips-1.31","label":"rke2-runtime-fips-1.31","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/rke2-runtime-fips-1.31","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"rke2-runtime-fips-1.32","name":"rke2-runtime-fips-1.32","label":"rke2-runtime-fips-1.32","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/rke2-runtime-fips-1.32","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"rke2-runtime-fips-1.33","name":"rke2-runtime-fips-1.33","label":"rke2-runtime-fips-1.33","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/rke2-runtime-fips-1.33","purlType":"apk","versions":[{"text":"< 1.33.10.2.3-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.33.10.2.3-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"rke2-runtime-fips-1.34","name":"rke2-runtime-fips-1.34","label":"rke2-runtime-fips-1.34","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/rke2-runtime-fips-1.34","purlType":"apk","versions":[{"text":"< 1.34.8.2.1-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.34.8.2.1-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"rke2-runtime-fips-1.35","name":"rke2-runtime-fips-1.35","label":"rke2-runtime-fips-1.35","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/rke2-runtime-fips-1.35","purlType":"apk","versions":[{"text":"< 1.35.5.2.1-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.35.5.2.1-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"spegel","name":"spegel","label":"spegel","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/spegel","purlType":"apk","versions":[{"text":"< 0.6.0-r11","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.6.0-r11","eol":null,"hubHref":null},{"vendor":"chainguard","product":"spegel-fips","name":"spegel-fips","label":"spegel-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/spegel-fips","purlType":"apk","versions":[{"text":"< 0.6.0-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.6.0-r8","eol":null,"hubHref":null},{"vendor":"wolfi","product":"ipfs-cluster","name":"ipfs-cluster","label":"ipfs-cluster","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/ipfs-cluster","purlType":"apk","versions":[{"text":"< 1.1.5-r11","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.1.5-r11","eol":null,"hubHref":null},{"vendor":"wolfi","product":"k3s","name":"k3s","label":"k3s","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/k3s","purlType":"apk","versions":[{"text":"< 1.35.3.1-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.35.3.1-r5","eol":null,"hubHref":null},{"vendor":"wolfi","product":"k3s-1.32","name":"k3s-1.32","label":"k3s-1.32","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/k3s-1.32","purlType":"apk","versions":[{"text":"< 1.32.13.1-r10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.32.13.1-r10","eol":null,"hubHref":null},{"vendor":"wolfi","product":"k3s-1.33","name":"k3s-1.33","label":"k3s-1.33","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/k3s-1.33","purlType":"apk","versions":[{"text":"< 1.33.10.1-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.33.10.1-r3","eol":null,"hubHref":null},{"vendor":"wolfi","product":"k3s-1.34","name":"k3s-1.34","label":"k3s-1.34","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/k3s-1.34","purlType":"apk","versions":[{"text":"< 1.34.6.1-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.34.6.1-r5","eol":null,"hubHref":null},{"vendor":"wolfi","product":"k3s-1.35","name":"k3s-1.35","label":"k3s-1.35","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/k3s-1.35","purlType":"apk","versions":[{"text":"< 1.35.3.1-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.35.3.1-r4","eol":null,"hubHref":null},{"vendor":"wolfi","product":"k3s-static","name":"k3s-static","label":"k3s-static","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/k3s-static","purlType":"apk","versions":[{"text":"< 1.35.3.1-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.35.3.1-r5","eol":null,"hubHref":null},{"vendor":"wolfi","product":"k3s-static-1.32","name":"k3s-static-1.32","label":"k3s-static-1.32","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/k3s-static-1.32","purlType":"apk","versions":[{"text":"< 1.32.13.1-r10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.32.13.1-r10","eol":null,"hubHref":null},{"vendor":"wolfi","product":"k3s-static-1.33","name":"k3s-static-1.33","label":"k3s-static-1.33","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/k3s-static-1.33","purlType":"apk","versions":[{"text":"< 1.33.10.1-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.33.10.1-r3","eol":null,"hubHref":null},{"vendor":"wolfi","product":"k3s-static-1.34","name":"k3s-static-1.34","label":"k3s-static-1.34","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/k3s-static-1.34","purlType":"apk","versions":[{"text":"< 1.34.6.1-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.34.6.1-r5","eol":null,"hubHref":null},{"vendor":"wolfi","product":"k3s-static-1.35","name":"k3s-static-1.35","label":"k3s-static-1.35","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/k3s-static-1.35","purlType":"apk","versions":[{"text":"< 1.35.3.1-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.35.3.1-r4","eol":null,"hubHref":null},{"vendor":"wolfi","product":"spegel","name":"spegel","label":"spegel","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/spegel","purlType":"apk","versions":[{"text":"< 0.6.0-r11","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.6.0-r11","eol":null,"hubHref":null},{"vendor":"github.com/ipld","product":"go-ipld-prime","name":"github.com/ipld/go-ipld-prime","label":"go-ipld-prime","ecosystem":"Go","cpePart":null,"purl":"pkg:golang/github.com/ipld/go-ipld-prime","purlType":"golang","versions":[{"text":"< 0.22.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.22.0","eol":null,"hubHref":null},{"vendor":"ipld","product":"go-ipld-prime","name":"go-ipld-prime","label":"go-ipld-prime","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 0.22.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.22.0","eol":null,"hubHref":"/vendor/ipld/go-ipld-prime"},{"vendor":"protocol","product":"go-ipld-prime","name":"go-ipld-prime","label":"go-ipld-prime","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 0.22.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.22.0","eol":null,"hubHref":"/vendor/protocol/go-ipld-prime"}],"affectedCount":41,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/ipld/go-ipld-prime/security/advisories/GHSA-378j-3jfj-8r9f","label":"github.com/ipld/go-ipld-prime/security/advisories/GHSA-378j-3jfj-8r9f","hostname":"github.com","tags":["X Refsource CONFIRM","Advisory","WEB","Vendor Advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35480.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35480.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35480","label":"nvd.nist.gov/vuln/detail/CVE-2026-35480","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/ipld/go-ipld-prime/commit/e43bf4a27055fe8d895671a731ee5041e2d983a9","label":"github.com/ipld/go-ipld-prime/commit/e43bf4a27055fe8d895671a731ee5041e2d983a9","hostname":"github.com","tags":["WEB","FIX"]},{"url":"https://github.com/ipld/go-ipld-prime","label":"github.com/ipld/go-ipld-prime","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://github.com/ipld/go-ipld-prime/releases/tag/v0.22.0","label":"github.com/ipld/go-ipld-prime/releases/tag/v0.22.0","hostname":"github.com","tags":["WEB"]}],"lineage":{"upstream":[],"downstream":["OPENSUSE-SU-2026:10543-1","OPENSUSE-SU-2026:21483-1"],"duplicates":[],"related":["CGA-GG2G-5Q7F-85CJ","OPENSUSE-SU-2026:10543-1","OPENSUSE-SU-2026:21483-1"]},"timeline":[{"kind":"published","date":"2026-04-07T14:43:24.781Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-04-09T14:40:11.103Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":25,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T17:44:35.967Z","stale":false,"partial":false}}