The vulnerability in the DAG-CBOR decoder allows an attacker to cause an unbounded memory allocation by embedding large collection size hints in CBOR headers. The decoder does not cap these hints, so a crafted payload can trigger the application to allocate memory far beyond normal limits, leading to crashes or severe performance degradation. This is a memory allocation overflow with potential to deny service.

go-ipld-prime, a Go implementation of IPLD for CBOR, before version 0.22.0. Any application using this library and processing CBOR input falls under the risk.

The CVSS score is 6.2 indicating moderate severity, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to supply a CBOR payload, so any exposed service or component that decodes CBOR could be targeted. The lack of EPSS data prevents a precise risk estimate, but the potential for resource exhaustion suggests that the risk remains significant for systems with untrusted CBOR input.