CVE-2016-10563
Downloads Resources over HTTP in go-ipfs-dep
CVE-2016-10563 is a high vulnerability (CVSS 8.1) in Ipfs Go-ipfs-dep, published May 31, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.76%, the 55th percentile. Fixed in go-ipfs-dep 0.4.4.
During the installation process, the go-ipfs-deps module before 0.4.4 insecurely downloads resources over HTTP. This allows for a MITM attack to compromise the integrity of the resources used by this module and could allow for further compromise.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
During the installation process, the go-ipfs-deps module before 0.4.4 insecurely downloads resources over HTTP. This allows for a MITM attack to compromise the integrity of the resources used by this module and could allow for further compromise.
- Record
CVE-2016-10563- CVSS 3.0
- 8.1 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-311, CWE-310
- Updated
- 2026-11-02
CVE List No score
During the installation process, the go-ipfs-deps module before 0.4.4 insecurely downloads resources over HTTP. This allows for a MITM attack to compromise the integrity of the resources used by this module and could allow for further compromise.
- Record
CVE-2016-10563- Weakness
- CWE-311
- Updated
- 2026-11-02
EUVDEUVD-2019-0287 No score
During the installation process, the go-ipfs-deps module before 0.4.4 insecurely downloads resources over HTTP. This allows for a MITM attack to compromise the integrity of the resources used by this module and could allow for further compromise.
- Record
EUVD-2019-0287- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g3xp-v2ff-x5c3 No score
Downloads Resources over HTTP in go-ipfs-dep
Affected versions of go-ipfs-deps insecurely download resources over HTTP.
In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.
Recommendation
Update to version 0.4.4 or later.
- Record
GHSA-g3xp-v2ff-x5c3- Weakness
- CWE-311
- Updated
- 2026-11-02
OSVGHSA-g3xp-v2ff-x5c3 No score
Downloads Resources over HTTP in go-ipfs-dep
Affected versions of go-ipfs-deps insecurely download resources over HTTP.
In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.
Recommendation
Update to version 0.4.4 or later.
- Record
GHSA-g3xp-v2ff-x5c3- Weakness
- CWE-311
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
go-ipfs-depnpm |
before 0.4.4 | 0.4.4 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |