What’s Vulnerable › Vulnerabilities

CVE-2023-23631: HAMT Decoding Panics in github.com/ipfs/go-unixfsnode

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-02-09 · updated 2026-06-17
• Weakness: CWE-400

Description

github.com/ipfs/go-unixfsnode is an ADL IPLD prime node that wraps go-codec-dagpb's implementation of protobuf to enable pathing. In versions priot to 1.5.2 trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are reading untrusted user input, an attacker can then trigger a panic. This is caused by bogus fanout parameter in the HAMT directory nodes. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected products

• ipfs go-unixfsnode: before 1.5.2 — fixed in 1.5.2

How to fix

Upgrade to a fixed version: ipfs go-unixfsnode 1.5.2. Check the vendor advisory for mitigations.

References

• https://github.com/ipfs/go-unixfsnode/commit/59050ea8bc458ae55246ae09243e6e165923e076
• https://github.com/ipfs/go-unixfsnode/commit/91b3d39d33ef0cd2aff2c95d50b2329350944b68
• https://github.com/ipfs/go-unixfsnode/commit/a4ed723727e0bdc2277158337c2fc0d82802d122
• https://github.com/ipfs/go-unixfsnode/security/advisories/GHSA-4gj3-6r43-3wfc
• https://github.com/ipfs/go-unixfsnode/commit/59050ea8bc458ae55246ae09243e6e165923e076
• https://github.com/ipfs/go-unixfsnode/commit/91b3d39d33ef0cd2aff2c95d50b2329350944b68
• https://github.com/ipfs/go-unixfsnode/commit/a4ed723727e0bdc2277158337c2fc0d82802d122
• https://github.com/ipfs/go-unixfsnode/security/advisories/GHSA-4gj3-6r43-3wfc

Get alerted when CVE-2023-23631 or the next vulnerability affects your stack