Read the docs
TI-2023-09454 Aliases CVE-2023-23625GHSA-q264-w97q-q778

Denial of service in HAMT Decoding in go-unixfs

Priority LOW 34CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

go-unixfs is an implementation of a unix-like filesystem on top of an ipld merkledag. Trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are reading untrusted user input, an attacker can then trigger a panic. This is caused by bogus `fanout` parameter in the HAMT directory nodes. Users are advised to upgrade to version 0.4.3 to resolve this issue. Users unable to upgrade should not feed untrusted user data to the decoding functions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00675 52nd percentileScored 2026-11-07
Fix Fixed go-unixfs (ipfs): 0.4.3github.com/ipfs/go-unixfs (Go): 0.4.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ipfsgo-unixfsbefore 0.4.30.4.3Patch availableCNA
—github.com/ipfs/go-unixfs (Go)before 0.4.30.4.3Patch availableGHSA-q264-w97q-q778
  • go-unixfs Vendoripfs Affected before 0.4.3 Fixed in 0.4.3 Patch available CNA
  • github.com/ipfs/go-unixfs (Go) Vendor— Affected before 0.4.3 Fixed in 0.4.3 Patch available GHSA-q264-w97q-q778

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:protocol:go-unixfs:*:*:*:*:*:go:*:*before 0.4.3VulnerableProtocol
  • cpe:2.3:a:protocol:go-unixfs:*:*:*:*:*:go:*:* Versions before 0.4.3 Vulnerable ·Protocol

Remediation

  • Fix · CNA go-unixfs (ipfs) Fixed in 0.4.3
  • Fix · GHSA-q264-w97q-q778 github.com/ipfs/go-unixfs (Go) Fixed in 0.4.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-23625
  2. 2026-10-03 Alias added: GHSA-q264-w97q-q778

References

Patch 1

Advisory 3

Other 2

  • TI-2023-09455 Denial of service when feeding malformed size arguments in go-bitfield CVSS 3.1HIGH 7.5
  • TI-2023-10871 Boxo bitswap/server: DOS unbounded persistent memory leak CVSS 3.1HIGH 8.2
  • TI-2020-08933 Exposure of Sensitive Information to an Unauthorized Actor in AEgir CVSS 3.1CRITICAL 9.6
  • TI-2022-07554 ProtoNode may be modified such that common method calls may panic in ipfs/go-merkledag CVSS 3.1HIGH 7.5
  • TI-2020-16104 Control character injection in console output CVSS 3.1HIGH 8.8
  • TI-2020-16100 Path traversal in ipfs go-ipfs CVSS 3.1HIGH 8.1
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences