CVE-2023-23625 json
Denial of service in HAMT Decoding in go-unixfs
published 2023-02-09 3 y ago modified 2026-09-10 1 mo ago also GHSA-q264-w97q-q778 , GO-2023-1557 , EUVD-2023-0769
- cvss
- 5.9
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 52%
- public exploits
- 0
- none known
Summary
go-unixfs is an implementation of a unix-like filesystem on top of an ipld merkledag. Trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are reading untrusted user input, an attacker can then trigger a panic. This is caused by bogus `fanout` parameter in the HAMT directory nodes. Users are advised to upgrade to version 0.4.3 to resolve this issue. Users unable to upgrade should not feed untrusted user data to the decoding functions.
Patch / fix
- go github.com/ipfs/go-unixfs 0.4.3
- protocol go-unixfs 0.4.3
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 19 mo ago
Exploit prediction
0.68% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/ipfs/go-unixfs | <0.4.3 |
0.4.3 |
Affected products
- ipfs go-unixfs
Classification
- Weakness
-
- CWE-400 Uncontrolled Resource Consumption
References
-
github.com
/ipfs/go-unixfs/commit/467d139a640ecee4f2e74643dafcc58bb3b54175
web, patch
-
github.com
/ipfs/go-unixfs/security/advisories/GHSA-q264-w97q-q778
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-23625
advisory
-
github.com
/advisories/GHSA-q264-w97q-q778
advisory
-
github.com
/ipfs/go-unixfs
package
-
pkg.go.dev
/vuln/GO-2023-1557
web
Sources
- CVE List CVE-2023-23625
- GitHub Advisory GHSA-q264-w97q-q778
- NVD CVE-2023-23625
- OSV GO-2023-1557
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.