GHSA-q264-w97q-q778

    Dashboard / Vulnerabilities / GHSA-q264-w97q-q778

    GHSA-q264-w97q-q778

    Published: 10 Feb 2023Last Modified: 10 Sept 2026

    Summary: Denial of service via HAMT Decoding Panics

    Details: ### Impact Trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are reading untrusted user input, an attacker can then trigger a panic. This is caused by bogus `fanout` parameter in the HAMT directory nodes. This include checks returned in [ipfs/go-bitfield GHSA-2h6c-j3gf-xp9r](https://github.com/ipfs/go-bitfield/security/advisories/GHSA-2h6c-j3gf-xp9r), as well as limiting the `fanout` to `<= 1024` (to avoid attempts of arbitrary sized allocations). ### Patches - https://github.com/ipfs/go-unixfs/commit/dbcc43ec3e2db0d01e8d80c55040bba3cf22cb4b ### Workarounds Do not feed untrusted user data to the decoding functions. ### References - https://github.com/ipfs/go-bitfield/security/advisories/GHSA-2h6c-j3gf-xp9r

    References: https://github.com/ipfs/go-unixfs/security/advisories/GHSA-q264-w97q-q778, https://nvd.nist.gov/vuln/detail/CVE-2023-23625, https://github.com/ipfs/go-unixfs/commit/467d139a640ecee4f2e74643dafcc58bb3b54175, https://github.com/advisories/GHSA-q264-w97q-q778, https://github.com/ipfs/go-unixfs, https://pkg.go.dev/vuln/GO-2023-1557

    Affected packages

    Package

    Name: github.com/ipfs/go-unixfs

    Purl: pkg:golang/github.com/ipfs/go-unixfs

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -0.4.3

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High