https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 00:03:48 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-221590 EUVD-2026-221590 https://cve.radiocsirt.org/vuln/euvd-2026-221590 https://cve.radiocsirt.org/vuln/fkie_cve-2023-23625 <p>go-unixfs is an implementation of a unix-like filesystem on top of an ipld merkledag. Trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are reading untrusted user input, an attacker can then trigger a panic. This is caused by bogus `fanout` parameter in the HAMT directory nodes. Users are advised to upgrade to version 0.4.3 to resolve this issue. Users unable to upgrade should not feed untrusted user data to the decoding functions.</p> <p>go-unixfs is an implementation of a unix-like filesystem on top of an ipld merkledag. Trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are reading untrusted user input, an attacker can then trigger a panic. This is caused by bogus `fanout` parameter in the HAMT directory nodes. Users are advised to upgrade to version 0.4.3 to resolve this issue. Users unable to upgrade should not feed untrusted user data to the decoding functions.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-23625 https://cve.radiocsirt.org/vuln/ghsa-q264-w97q-q778 <p><strong>Affected:</strong> Go: github.com/ipfs/go-unixfs</p> <p>### Impact Trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are reading untrusted user input, an attacker can then trigger a panic.</p> <p>This is caused by bogus `fanout` parameter in the HAMT directory nodes. This include checks returned in [ipfs/go-bitfield GHSA-2h6c-j3gf-xp9r](https://github.com/ipfs/go-bitfield/security/advisories/GHSA-2h6c-j3gf-xp9r), as well as limiting the `fanout` to `&lt;= 1024` (to avoid attempts of arbitrary sized allocations).</p> <p>### Patches - https://github.com/ipfs/go-unixfs/commit/dbcc43ec3e2db0d01e8d80c55040bba3cf22cb4b</p> <p>### Workarounds Do not feed untrusted user data to the decoding functions.</p> <p>### References - https://github.com/ipfs/go-bitfield/security/advisories/GHSA-2h6c-j3gf-xp9r</p> <p><strong>Affected:</strong> Go: github.com/ipfs/go-unixfs</p> <p>### Impact Trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are reading untrusted user input, an attacker can then trigger a panic.</p> <p>This is caused by bogus `fanout` parameter in the HAMT directory nodes. This include checks returned in [ipfs/go-bitfield GHSA-2h6c-j3gf-xp9r](https://github.com/ipfs/go-bitfield/security/advisories/GHSA-2h6c-j3gf-xp9r), as well as limiting the `fanout` to `&lt;= 1024` (to avoid attempts of arbitrary sized allocations).</p> <p>### Patches - https://github.com/ipfs/go-unixfs/commit/dbcc43ec3e2db0d01e8d80c55040bba3cf22cb4b</p> <p>### Workarounds Do not feed untrusted user data to the decoding functions.</p> <p>### References - https://github.com/ipfs/go-bitfield/security/advisories/GHSA-2h6c-j3gf-xp9r</p> https://cve.radiocsirt.org/vuln/ghsa-q264-w97q-q778 https://cve.radiocsirt.org/vuln/gsd-2023-23625 gsd-2023-23625 https://cve.radiocsirt.org/vuln/gsd-2023-23625