{"id":"CVE-2023-23625","aliases":["GHSA-q264-w97q-q778","GO-2023-1557"],"url":"https://o3.security/vulnerability/CVE-2023-23625","summary":"Denial of service in HAMT Decoding in go-unixfs ","details":"### Impact\nTrying to read malformed HAMT sharded directories can cause panics and virtual memory leaks.\nIf you are reading untrusted user input, an attacker can then trigger a panic.\n\nThis is caused by bogus `fanout` parameter in the HAMT directory nodes.\nThis include checks returned in [ipfs/go-bitfield GHSA-2h6c-j3gf-xp9r](https://github.com/ipfs/go-bitfield/security/advisories/GHSA-2h6c-j3gf-xp9r), as well as limiting the `fanout` to `<= 1024` (to avoid attempts of arbitrary sized allocations).\n\n### Patches\n- https://github.com/ipfs/go-unixfs/commit/dbcc43ec3e2db0d01e8d80c55040bba3cf22cb4b\n\n### Workarounds\nDo not feed untrusted user data to the decoding functions.\n\n### References\n- https://github.com/ipfs/go-bitfield/security/advisories/GHSA-2h6c-j3gf-xp9r\n","published":"2023-02-09T20:57:22.072Z","modified":"2026-10-28T02:31:09.231520685Z","cvss":{"score":5.9,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/ipfs/go-unixfs","fixedVersion":"0.4.3"}],"fix":{"url":"https://github.com/ipfs/go-unixfs/commit/467d139a640ecee4f2e74643dafcc58bb3b54175","label":"ipfs/go-unixfs@467d139"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/23xxx/CVE-2023-23625.json"},{"type":"ADVISORY","url":"https://github.com/ipfs/go-unixfs/security/advisories/GHSA-q264-w97q-q778"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-23625"},{"type":"FIX","url":"https://github.com/ipfs/go-unixfs/commit/467d139a640ecee4f2e74643dafcc58bb3b54175"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-q264-w97q-q778"},{"type":"PACKAGE","url":"https://github.com/ipfs/go-unixfs"},{"type":"WEB","url":"https://pkg.go.dev/vuln/GO-2023-1557"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:31:09.231520685Z"}}