Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
🐹
🐹 Go
Not in CISA KEV
HIGH severity

GHSA-m974-xj4j-7qv5 — go-libipfs

HIGHFix: ipfs/boxo@62cbac4

GHSA-m974-xj4j-7qv5 is a high-severity (CVSS 8.2) Uncontrolled Resource Consumption vulnerability in github.com/ipfs/go-libipfs. A fix is available for github.com/ipfs/go-libipfs — see the affected versions and patch details below.

Boxo bitswap/server: DOS unbounded persistent memory leak

Also known asCVE-2023-25568GHSA-q3j6-22wf-3jh9GO-2023-1766
Published
May 11, 2023
Updated
Sep 10, 2026
Affected
2 pkgs
Patched
2 / 2
Exploits
None indexed
Exploitation data as of Sep 20, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for GHSA-m974-xj4j-7qv5.

EPSS Exploitation Probability

via FIRST.org ↗
0.9%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs57th percentile — riskier than 57% of all scored CVEsHighest risk

EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.

How urgent is this, really

GHSA-m974-xj4j-7qv5 plotted by exploitation likelihood (EPSS) against impact (CVSS). The shaded corner — EPSS 50%+ and CVSS 7.0+ — is where this CVE doesn't sit, though severity or exploitability alone can still warrant action.

Where this sits among everything scored

Of 377,333 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Real counts from FIRST.org, not a sample — log-scaled since the landscape is heavily right-skewed.

Real-World Exposure

2 pkgs affected
🐹github.com/ipfs/go-libipfs🐹github.com/ipfs/go-libipfs

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

Description

Impact

An attacker is able allocate arbitrarily many bytes in the Bitswap server by sending many WANT_BLOCK and or WANT_HAVE requests which are queued in an unbounded queue, with allocations that persist even if the connection is closed. This affects users accepting untrusted connections with the Bitswap server, this also affects users using the old API stubs at github.com/ipfs/boxo/bitswap because it transitively uses github.com/ipfs/boxo/bitswap/server.

We have renamed go-libipfs to boxo; this document uses both terms interchangeably. The version numbers for both are applicable, as they share the same historical timeline.

Remediation

Apply one of:

  • Update boxo to v0.6.0 or later
  • Update boxo to v0.4.1 Note that v0.5.0 is NOT safe, v0.4.1 is a backport of the v0.6.0 security fixes on top of v0.4.0.

Mitigations

  1. The server now limits how many wantlist entries per peer it knows. The MaxQueuedWantlistEntriesPerPeer option allows configuring how many wantlist entries the server remembers; if a peer sends a wantlist bigger than this (including a sum of multiple delta updates) the server will truncate the wantlist to the match the limit. This defaults to 1024 entries per peer.
  2. The server now properly clears state about peers when they disconnect. Peer state is more lazily allocated (only when a wantlist is received in the first place) and is properly cleared when the PeerDisconnected callback is received.
  3. The server now ignores CIDs above some size. Clients were able to send any CID as long as the total protobuf message were bellow the 4MiB limit. This is allowed to allocate lots of memory with very little entries. This can be configured using the MaxCidSize option and defaults to 168 bytes.
  4. The server now closes the connection if an inline CID is requested (either as WANT_* or CANCEL). The attack were more effective if done with CIDs that are present in target's blockstore, this is because this will push longer-lasting jobs on some priority queue. Since inline CID are literal data (instead of hashes of data), everyone always "has" any inline CID (since instead of loading the data from disk, it can be extracted from the CID). It makes no sense for anyone to ever ask you about an inline CID since they could also just parse it themselves. Thus, as a defensive measure, we kill the connection with peers that ask about an inline CID.

Vulnerable symbols

  • github.com/ipfs/go-libipfs/bitswap/server/internal/decision.(*Engine).MessageReceived
  • github.com/ipfs/go-libipfs/bitswap/server/internal/decision.(*Engine).NotifyNewBlocks
  • github.com/ipfs/go-libipfs/bitswap/server/internal/decision.(*Engine).findOrCreate
  • github.com/ipfs/go-libipfs/bitswap/server/internal/decision.(*Engine).PeerConnected

Patches

Workarounds

If you are using the stubs at github.com/ipfs/go-libipfs/bitswap and not taking advantage of the features provided by the server, refactoring your code to use the new split API will allow you to run in a client-only mode using: github.com/ipfs/boxo/bitswap/client.

Affected Packages

2 total 2 fixed
EcosystemPackageVulnerable rangeFix
🐹Gogithub.com/ipfs/go-libipfs≥ 0.5.0&&< 0.6.00.6.0go get github.com/ipfs/go-libipfs@v0.6.0
🐹Gogithub.com/ipfs/go-libipfsall versions0.4.1go get github.com/ipfs/go-libipfs@v0.4.1

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/ipfs/go-libipfs, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update github.com/ipfs/go-libipfs to 0.6.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-m974-xj4j-7qv5 is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

  4. How O3 protects you

    O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-m974-xj4j-7qv5 can be triaged on real exposure rather than presence alone.

Tailored to GHSA-m974-xj4j-7qv5. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

### Impact An attacker is able allocate arbitrarily many bytes in the Bitswap server by sending many `WANT_BLOCK` and or `WANT_HAVE` requests which are queued in an unbounded queue, with allocations that persist even if the connection is closed. This affects users accepting untrusted connections with the Bitswap server, this also affects users using the old API stubs at `github.com/ipfs/boxo/bitswap` because it transitively uses `github.com/ipfs/boxo/bitswap/server`. We have [renamed go-libipfs to boxo](https://github.com/ipfs/boxo/issues/215); this document uses both terms interchangeably. T
O3 Security · Impact-Aware SCA

Is GHSA-m974-xj4j-7qv5 in your dependencies?

O3 Security finds GHSA-m974-xj4j-7qv5 across Go dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.

Scan my dependencies How O3 SCA works
GHSA-m974-xj4j-7qv5: go-libipfs (High 8.2) | O3 Security