CVE-2023-23625 - CVE House
Back to Database
Status published Medium CVE-2023-23625

Denial of service in HAMT Decoding in go-unixfs

Vulnerability Description

go-unixfs is an implementation of a unix-like filesystem on top of an ipld merkledag. Trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are reading untrusted user input, an attacker can then trigger a panic. This is caused by bogus `fanout` parameter in the HAMT directory nodes. Users are advised to upgrade to version 0.4.3 to resolve this issue. Users unable to upgrade should not feed untrusted user data to the decoding functions.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-23625

Credits & Attribution

No credits recorded in the NVD database.

References

More from ipfs

View All →
CVE-2023-25568
Boxo bitswap/server: DOS unbounded persistent memory leak
High 8.2
CVE-2023-23631
HAMT Decoding Panics in github.com/ipfs/go-unixfsnode
Medium 5.9
CVE-2023-23626
Denial of service when feeding malformed size arguments in go-bitfield
Medium 5.9
CVE-2022-23495
ProtoNode may be modified such that common method calls may panic in ipfs/go-merkledag
High 7.5
CVE-2020-26283
Control character injection in console output
Medium 6.8

Affected Vendor

Affected Software

go-unixfs
Vulnerable Versions:
< 0.4.3

Timeline

Official Publish: February 9th, 2023
Last Modified: March 10th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-400

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service
Impact
T1498 Network Denial of Service
Impact