Skip to content
OpenAdvisories

Vendor

filecoin-project

5 known vulnerabilities.

Products

filecoin-pin 2 go-f3 2 lotus 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-62300

    Filecoin Pin: Unbounded DAG pinning can exhaust filecoin-pin server resources

    Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP service. In daemon deployments up to and including version 1.1.0, `POST /pins` in `src/filecoin-pinning-server.ts` checks a caller-supplied CID with `CID.parse` and passes …

    filecoin-project filecoin-pin filecoin-pin npm
  • Medium 5.9
    CVE-2025-59941

    go-f3 is Vulnerable to Cached Justification Verification Bypass

    go-f3 is a Golang implementation of Fast Finality for Filecoin (F3). In versions 0.8.8 and below, go-f3's justification verification caching mechanism has a vulnerability where verification results are cached without properly considering the context of the me…

    filecoin-project go-f3 github.com/filecoin-project/go-f3 Go
  • Medium 5.9
    CVE-2021-21405

    BLS Signature "Malleability"

    Lotus is an Implementation of the Filecoin protocol written in Go. BLS signature validation in lotus uses blst library method VerifyCompressed. This method accepts signatures in 2 forms: "serialized", and "compressed", meaning that BLS signatures can be provi…

    filecoin-project lotus github.com/filecoin-project/lotus Go