{"id":"CVE-2023-23625","aliases":["EUVD-2023-0769","GHSA-q264-w97q-q778","GO-2023-1557"],"status":"published","title":"Denial of service in HAMT Decoding in go-unixfs","description":"go-unixfs is an implementation of a unix-like filesystem on top of an ipld merkledag. Trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are reading untrusted user input, an attacker can then trigger a panic. This is caused by bogus `fanout` parameter in the HAMT directory nodes. Users are advised to upgrade to version 0.4.3 to resolve this issue. Users unable to upgrade should not feed untrusted user data to the decoding functions.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00675,"percentile":0.5252,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2023-02-09T20:57:22Z","modified":"2026-10-28T02:31:09Z","fixes":[{"ecosystem":"Go","package":"github.com/ipfs/go-unixfs","fixed_in":["0.4.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/ipfs/go-unixfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/ipfs/go-unixfs","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.4.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/ipfs/go-unixfs","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.4.3"}]}]}],"products":[{"vendor":"ipfs","product":"go-unixfs"},{"vendor":"protocol","product":"go-unixfs"}],"references":[{"url":"https://github.com/ipfs/go-unixfs/security/advisories/GHSA-q264-w97q-q778","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://github.com/ipfs/go-unixfs/commit/467d139a640ecee4f2e74643dafcc58bb3b54175","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-23625","tags":["advisory"]},{"url":"https://pkg.go.dev/vuln/GO-2023-1557","tags":["web"]},{"url":"https://github.com/advisories/GHSA-q264-w97q-q778","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/23xxx/CVE-2023-23625.json","tags":["advisory"]},{"url":"https://github.com/ipfs/go-unixfs","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-23625","title":"Denial of service in HAMT Decoding in go-unixfs ","description":"go-unixfs is an implementation of a unix-like filesystem on top of an ipld merkledag. Trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are reading untrusted user input, an attacker can then trigger a panic. This is caused by bogus `fanout` parameter in the HAMT directory nodes. Users are advised to upgrade to version 0.4.3 to resolve this issue. Users unable to upgrade should not feed untrusted user data to the decoding functions.\n","status":"published","published":"2023-02-09T20:57:22.072Z","modified":"2025-03-10T21:13:58.723Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:35:20.812737Z"}],"euvd":[{"id":"EUVD-2023-0769","description":"go-unixfs is an implementation of a unix-like filesystem on top of an ipld merkledag. Trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are reading untrusted user input, an attacker can then trigger a panic. This is caused by bogus `fanout` parameter in the HAMT directory nodes. Users are advised to upgrade to version 0.4.3 to resolve this issue. Users unable to upgrade should not feed untrusted user data to the decoding functions.\n","status":"published","published":"2023-02-09T20:57:22Z","modified":"2025-03-10T21:13:58Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T20:53:09.197707Z"}],"ghsa":[{"id":"GHSA-q264-w97q-q778","title":"Denial of service via HAMT Decoding Panics","description":"### Impact\nTrying to read malformed HAMT sharded directories can cause panics and virtual memory leaks.\nIf you are reading untrusted user input, an attacker can then trigger a panic.\n\nThis is caused by bogus `fanout` parameter in the HAMT directory nodes.\nThis include checks returned in [ipfs/go-bitfield GHSA-2h6c-j3gf-xp9r](https://github.com/ipfs/go-bitfield/security/advisories/GHSA-2h6c-j3gf-xp9r), as well as limiting the `fanout` to `\u003c= 1024` (to avoid attempts of arbitrary sized allocations).\n\n### Patches\n- https://github.com/ipfs/go-unixfs/commit/dbcc43ec3e2db0d01e8d80c55040bba3cf22cb4b\n\n### Workarounds\nDo not feed untrusted user data to the decoding functions.\n\n### References\n- https://github.com/ipfs/go-bitfield/security/advisories/GHSA-2h6c-j3gf-xp9r\n","status":"published","published":"2023-02-10T23:08:06Z","modified":"2024-05-20T21:43:32Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:37:50.750599Z"}],"nvd":[{"id":"CVE-2023-23625","description":"go-unixfs is an implementation of a unix-like filesystem on top of an ipld merkledag. Trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are reading untrusted user input, an attacker can then trigger a panic. This is caused by bogus `fanout` parameter in the HAMT directory nodes. Users are advised to upgrade to version 0.4.3 to resolve this issue. Users unable to upgrade should not feed untrusted user data to the decoding functions.\n","status":"published","published":"2023-02-09T21:15:11.327Z","modified":"2026-06-17T05:37:36.87Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:07:46.811196Z"}],"osv":[{"id":"CVE-2023-23625","title":"Denial of service in HAMT Decoding in go-unixfs ","description":"go-unixfs is an implementation of a unix-like filesystem on top of an ipld merkledag. Trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are reading untrusted user input, an attacker can then trigger a panic. This is caused by bogus `fanout` parameter in the HAMT directory nodes. Users are advised to upgrade to version 0.4.3 to resolve this issue. Users unable to upgrade should not feed untrusted user data to the decoding functions.\n","status":"published","published":"2023-02-09T20:57:22.072Z","modified":"2026-10-28T02:31:09.231520685Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:44:30.709518Z"},{"id":"GHSA-q264-w97q-q778","title":"Denial of service via HAMT Decoding Panics","description":"### Impact\nTrying to read malformed HAMT sharded directories can cause panics and virtual memory leaks.\nIf you are reading untrusted user input, an attacker can then trigger a panic.\n\nThis is caused by bogus `fanout` parameter in the HAMT directory nodes.\nThis include checks returned in [ipfs/go-bitfield GHSA-2h6c-j3gf-xp9r](https://github.com/ipfs/go-bitfield/security/advisories/GHSA-2h6c-j3gf-xp9r), as well as limiting the `fanout` to `\u003c= 1024` (to avoid attempts of arbitrary sized allocations).\n\n### Patches\n- https://github.com/ipfs/go-unixfs/commit/dbcc43ec3e2db0d01e8d80c55040bba3cf22cb4b\n\n### Workarounds\nDo not feed untrusted user data to the decoding functions.\n\n### References\n- https://github.com/ipfs/go-bitfield/security/advisories/GHSA-2h6c-j3gf-xp9r\n","status":"published","published":"2023-02-10T23:08:06Z","modified":"2026-09-10T03:49:52.056631392Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:53.700556Z"},{"id":"GO-2023-1557","title":"Denial of service via HAMT decoding panic in github.com/ipfs/go-unixfs","description":"Trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are reading untrusted user input, an attacker can then trigger a panic.\n\nThis is caused by bogus \"fanout\" parameter in the HAMT directory nodes. A workaround is to not feed untrusted user data to the decoding functions.","status":"published","published":"2023-02-14T19:34:46Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:01.185262Z"}]}}