Most recent entries from all

EUVD-2026-221590

2026-10-03T21:35:42.328848+00:00

EUVD-2026-221590

fkie_cve-2023-23625

2026-10-03T21:35:42.328886+00:00

go-unixfs is an implementation of a unix-like filesystem on top of an ipld merkledag. Trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are reading untrusted user input, an attacker can then trigger a panic. This is caused by bogus `fanout` parameter in the HAMT directory nodes. Users are advised to upgrade to version 0.4.3 to resolve this issue. Users unable to upgrade should not feed untrusted user data to the decoding functions.

GHSA-q264-w97q-q778 — Denial of service via HAMT Decoding Panics

2026-10-03T21:35:42.328922+00:00

Affected: Go: github.com/ipfs/go-unixfs

### Impact Trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are reading untrusted user input, an attacker can then trigger a panic.

This is caused by bogus `fanout` parameter in the HAMT directory nodes. This include checks returned in [ipfs/go-bitfield GHSA-2h6c-j3gf-xp9r](https://github.com/ipfs/go-bitfield/security/advisories/GHSA-2h6c-j3gf-xp9r), as well as limiting the `fanout` to `<= 1024` (to avoid attempts of arbitrary sized allocations).

### Patches - https://github.com/ipfs/go-unixfs/commit/dbcc43ec3e2db0d01e8d80c55040bba3cf22cb4b

### Workarounds Do not feed untrusted user data to the decoding functions.

### References - https://github.com/ipfs/go-bitfield/security/advisories/GHSA-2h6c-j3gf-xp9r

gsd-2023-23625

2026-10-03T21:35:42.328956+00:00

gsd-2023-23625