Priority LOW 27
go-ipld-prime is an implementation of the InterPlanetary Linked Data (IPLD) spec interfaces, a batteries-included codec implementations of IPLD for CBOR and JSON, and tooling for basic operations on IPLD objects.
CVSS 3.1MEDIUM 6.2· Local · No auth · No interaction · EPSS 0.00162 · Published 2026-04-07 · Fixed in 0.22.0 CWE-770
Priority HIGH 75
libp2p-rust is the official rust language Implementation of the libp2p networking stack.
CVSS 3.1HIGH 8.2· Network · No auth · No interaction · EPSS 0.00296 · Published 2026-04-07 · Fixed in 0.17.1 CWE-770
Priority HIGH 72
libp2p-rust is the official rust language Implementation of the libp2p networking stack.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0041 · Published 2026-04-07 · Fixed in 0.17.1 CWE-770
Priority LOW 36
libp2p-rust is the official rust language Implementation of the libp2p networking stack.
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.00583 · Published 2026-03-31 · Fixed in 0.49.4 CWE-190
Priority MEDIUM 45
libp2p-rust is the official rust language Implementation of the libp2p networking stack.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00602 · Published 2026-03-20 · Fixed in 0.49.3 CWE-190
Priority MEDIUM 44
Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00479 · Published 2026-03-13 · Fixed in 0.13.10 CWE-248
Priority MEDIUM 40
Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00481 · Published 2026-03-13 · Fixed in 0.13.9 CWE-190
Priority MEDIUM 41
libp2p is a networking stack and library modularized out of The IPFS Project, and bundled separately for other tools to use.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00952 · Published 2023-08-25 · Fixed in 0.27.4 CWE-400
Priority MEDIUM 43
Boxo, formerly known as go-libipfs, is a library for building IPFS applications and implementations.
CVSS 3.1HIGH 8.2· Network · No auth · No interaction · EPSS 0.00856 · Published 2023-05-10 · Fixed in 0.6.0, 0.4.1 CWE-400
Priority LOW 34
go-unixfs is an implementation of a unix-like filesystem on top of an ipld merkledag.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00675 · Published 2023-02-09 · Fixed in 0.4.3 CWE-400
Priority HIGH 66
go-bitfield is a simple bitfield package for the go language aiming to be more performant that the standard library.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0091 · Published 2023-02-09 · Fixed in 1.1.0 CWE-754
Priority LOW 35
github.com/ipfs/go-unixfsnode is an ADL IPLD prime node that wraps go-codec-dagpb's implementation of protobuf to enable pathing.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00908 · Published 2023-02-09 · Fixed in 1.5.2 CWE-400
Priority MEDIUM 41
go-ipld-prime is an implementation of the InterPlanetary Linked Data (IPLD) spec interfaces, a batteries-included codec implementations of IPLD for CBOR and JSON, and tooling for basic operations on IPLD objects.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01165 · Published 2023-01-04 · Fixed in 0.19.0 CWE-20
Priority LOW 34
The dag-pb codec can panic when decoding invalid blocks.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00771 · Published 2022-12-27 · Fixed in 1.3.1 CWE-119
Priority LOW 31
GossipSub 1.1, as used for Ethereum 2.0, allows a peer to maintain a positive score (and thus not be pruned from the network) even though it continuously misbehaves by never forwarding topic messages.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00555 · Published 2022-12-19 · No fix listed CWE-281
Priority MEDIUM 42
go-merkledag implements the 'DAGService' interface and adds two ipld node types, Protobuf and Raw for the ipfs project.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0138 · Published 2022-12-08 · Fixed in 0.8.1 CWE-755
Priority MEDIUM 41
go-libp2p is the offical libp2p implementation in the Go programming language.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01051 · Published 2022-12-08 · Fixed in 0.18.0 CWE-400
Priority MEDIUM 40
js-libp2p is the official javascript Implementation of libp2p networking stack.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00734 · Published 2022-12-07 · Fixed in 0.38.0 CWE-400
Priority MEDIUM 40
libp2p-rust is the official rust language Implementation of the libp2p networking stack.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00734 · Published 2022-12-07 · Fixed in 0.45.1 CWE-400
Priority MEDIUM 41
go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01501 · Published 2021-03-24 · Fixed in 0.8.0 CWE-116
Priority LOW 39
go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.01699 · Published 2021-03-24 · Fixed in 0.8.0-rc1, 0.8.0 CWE-22
Priority LOW 36
An issue was discovered in the multihash crate before 0.11.3 for Rust.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01388 · Published 2020-12-31 · Fixed in 0.11.3 CWE-20
Priority LOW 35
An issue was discovered in IPFS (aka go-ipfs) 0.4.23.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01161 · Published 2020-11-02 · Fixed in 0.7.0 CWE-284
Priority MEDIUM 46
Gossipsub 1.0 does not properly resist invalid message spam, such as an eclipse attack or a sybil attack.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01937 · Published 2020-07-07 · No fix listed
THREATIST.IORead the docs