Ipfs

9 CVEs across 8 Ipfs products. Browse Ipfs vulnerabilities, severities, and proof-of-concept exploits.

Ipfs products with known CVEs

ProductCVEs
Go-Ipfs2
Aegir1
Boxo1
Go-Bitfield1
Go-Ipfs-Dep1
Go-Merkledag1
Go-Unixfs1
Go-Unixfsnode1
Ipfs CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2023-25568High8.22023-05-10Boxo, formerly known as go-libipfs, is a library for building IPFS applications and implementations. In versions 0.4.0 and 0.5.0, if an attacker is able alloca…
CVE-2023-23631Medium5.92023-02-09github.com/ipfs/go-unixfsnode is an ADL IPLD prime node that wraps go-codec-dagpb's implementation of protobuf to enable pathing. In versions priot to 1.5.2 tr…
CVE-2023-23626Medium5.92023-02-09go-bitfield is a simple bitfield package for the go language aiming to be more performant that the standard library. When feeding untrusted user input into the…
CVE-2023-23625Medium5.92023-02-09go-unixfs is an implementation of a unix-like filesystem on top of an ipld merkledag. Trying to read malformed HAMT sharded directories can cause panics and vi…
CVE-2022-23495High7.52022-12-08go-merkledag implements the 'DAGService' interface and adds two ipld node types, Protobuf and Raw for the ipfs project. A `ProtoNode` may be modified in such a…
CVE-2020-26283Medium6.82021-03-24go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem. In go-ipfs before version 0.8.0, control charact…
CVE-2020-26279High7.72021-03-24go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem. In go-ipfs before version 0.8.0-rc1, it is possi…
CVE-2020-11059Critical9.62020-05-27In AEgir greater than or equal to 21.7.0 and less than 21.10.1, aegir publish and aegir build may leak secrets from environment variables in the browser bundle…
CVE-2016-10563High8.12018-05-31During the installation process, the go-ipfs-deps module before 0.4.4 insecurely downloads resources over HTTP. This allows for a MITM attack to compromise the…