Ipfs vulnerabilities
We track 5 vulnerabilities in Ipfs products across 5 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on May 10, 2023.
Latest Ipfs vulnerabilities
- 7.5 High severity
boxo: Allocation of Resources Without Limits or Throttling
Boxo, formerly known as go-libipfs, is a library for building IPFS applications and implementations. In versions 0.4.0 and 0.5.0, if an attacker is able allocate arbitrary many bytes in the Bitswap server, those allocations are lasting even if the connection i
- 7.5 High severity
go-unixfsnode: Uncontrolled Resource Consumption
github.com/ipfs/go-unixfsnode is an ADL IPLD prime node that wraps go-codec-dagpb's implementation of protobuf to enable pathing. In versions priot to 1.5.2 trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are
- 7.5 High severity
go-bitfield: Improper Validation of Specified Quantity in Input
go-bitfield is a simple bitfield package for the go language aiming to be more performant that the standard library. When feeding untrusted user input into the size parameter of `NewBitfield` and `FromBytes` functions, an attacker can trigger `panic`s. This ha
- 7.5 High severity
go-unixfs: Uncontrolled Resource Consumption
go-unixfs is an implementation of a unix-like filesystem on top of an ipld merkledag. Trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are reading untrusted user input, an attacker can then trigger a panic. Th
- 7.5 High severity
go-merkledag: Unchecked Return Value
go-merkledag implements the 'DAGService' interface and adds two ipld node types, Protobuf and Raw for the ipfs project. A `ProtoNode` may be modified in such a way as to cause various encode errors which will trigger a panic on common method calls that don't a