ipfs github.com/ipfs/go-bitswap vulnerabilities

Latest ipfs github.com/ipfs/go-bitswap CVEs

Newest publication first

1. GHSA-q3j6-22wf-3jh9 github.com/ipfs/go-bitswap vulnerable to DOS unbounded persistent memory leak

   Published 2023-05-11

   High·CVSS 7.5

   This package has been moved to github.com/ipfs/boxo/bitswap, this vulnerability is tracked there: https://github.com/ipfs/boxo/security/advisories/GHSA-m974-xj4j-7qv5 (CVE-2023-25568) Remediation This is a two step process: Apply one of: (recommended) upgrade from github.com/ipfs...

2. CVE-2023-25568 Boxo bitswap/server: DOS unbounded persistent memory leak

   Published 2023-05-10

   High·CVSS 7.5 EPSS 0.86%

   Boxo, formerly known as go-libipfs, is a library for building IPFS applications and implementations. In versions 0.4.0 and 0.5.0, if an attacker is able allocate arbitrary many bytes in the Bitswap server, those allocations are lasting even if the connection is closed. This affec...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.