Uncontrolled Recursion Affecting spegel package, versions <0.7.0-r2

Note: Versions mentioned in the description apply only to the upstream spegel package and not the spegel package as distributed by Wolfi. See How to fix? for Wolfi relevant fixed versions and status.

go-ipld-prime is an implementation of the InterPlanetary Linked Data (IPLD) spec interfaces, a batteries-included codec implementations of IPLD for CBOR and JSON, and tooling for basic operations on IPLD objects. Prior to 0.23.0, the DAG-CBOR and DAG-JSON decoders recurse on each nested map or list without a depth limit. A payload containing deeply nested collections causes the decoder to recurse once per level, growing the goroutine stack until the Go runtime terminates the process with a fatal stack overflow (distinct from a recoverable panic). This vulnerability is fixed in 0.23.0.

• https://github.com/ipld/go-ipld-prime/security/advisories/GHSA-w239-58x2-q8p5