Skip to content
OpenAdvisories

Vendor

ipfs

8 known vulnerabilities.

Products

go-ipfs 2 go-unixfs 1 go-bitfield 1 go-unixfsnode 1 AEgir 1 go-merkledag 1 boxo 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.2
    CVE-2023-25568

    Boxo bitswap/server: DOS unbounded persistent memory leak

    Boxo, formerly known as go-libipfs, is a library for building IPFS applications and implementations. In versions 0.4.0 and 0.5.0, if an attacker is able allocate arbitrary many bytes in the Bitswap server, those allocations are lasting even if the connection …

    ipfs boxo github.com/ipfs/go-libipfs github.com/ipfs/go-bitswap Go
  • High 7.5
    CVE-2022-23495

    ProtoNode may be modified such that common method calls may panic in ipfs/go-merkledag

    go-merkledag implements the 'DAGService' interface and adds two ipld node types, Protobuf and Raw for the ipfs project. A `ProtoNode` may be modified in such a way as to cause various encode errors which will trigger a panic on common method calls that don't …

    ipfs go-merkledag github.com/ipfs/go-merkledag Go
  • High 7.7
    CVE-2020-26279

    Path traversal

    go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem. In go-ipfs before version 0.8.0-rc1, it is possible for path traversal to occur with DAGs containing relative paths during retrieval. This can cause…

    ipfs go-ipfs github.com/ipfs/go-ipfs kubo Alpine Go