CVE-2023-23631 - CVE House
Back to Database
Status published Medium CVE-2023-23631

HAMT Decoding Panics in github.com/ipfs/go-unixfsnode

Vulnerability Description

github.com/ipfs/go-unixfsnode is an ADL IPLD prime node that wraps go-codec-dagpb's implementation of protobuf to enable pathing. In versions priot to 1.5.2 trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are reading untrusted user input, an attacker can then trigger a panic. This is caused by bogus fanout parameter in the HAMT directory nodes. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-23631

Credits & Attribution

No credits recorded in the NVD database.

References

More from ipfs

View All →
CVE-2023-25568
Boxo bitswap/server: DOS unbounded persistent memory leak
High 8.2
CVE-2023-23626
Denial of service when feeding malformed size arguments in go-bitfield
Medium 5.9
CVE-2023-23625
Denial of service in HAMT Decoding in go-unixfs
Medium 5.9
CVE-2022-23495
ProtoNode may be modified such that common method calls may panic in ipfs/go-merkledag
High 7.5
CVE-2020-26283
Control character injection in console output
Medium 6.8

Affected Vendor

Affected Software

go-unixfsnode
Vulnerable Versions:
< 1.5.2

Timeline

Official Publish: February 9th, 2023
Last Modified: March 10th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-400

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service
Impact
T1498 Network Denial of Service
Impact