Description
The Kademlia DHT (go-libp2p-kad-dht 0.20.0 and earlier) used in IPFS (0.18.1 and earlier) assigns routing information for content (i.e., information about who holds the content) to be stored by peers whose peer IDs have a small DHT distance from the content ID. This allows an attacker to censor content by generating many Sybil peers whose peer IDs have a small distance from the content ID, thus hijacking the content resolution process.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20241213T205935-1.1 | openSUSE-SU-2024:14599-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | k3s-1.32 +1 | 1.32.13.1-r22 | — |
| Wolfi rolling | k3s-1.34 +1 | 1.34.9.1-r1 | — |
| Wolfi rolling | k3s-1.35 +1 | 1.35.6.1-r2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/libp2p/go-libp2p-kad-dht | <= 0.20.0 | — | GHSA-mqr9-hjr8-2m9w |
| Go | github.com/libp2p/go-libp2p-kad-dht | all versions | — | GO-2024-3218 |
Advisories 1
- openSUSE-SU-2024:14599-1 govulncheck-vulndb-0.0.20241213T205935-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026