GHSA-mcq2-w56r-5w2w
Daemon panics when processing certain blocks
Blast Radius
github.com/ipld/go-ipfs🐹github.com/ipld/go-ipfsReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.
Description
Impact
go-ipfs nodes with versions 0.10.0, 0.11.0, 0.12.0, or 0.12.1 can crash when trying to traverse certain malformed graphs due to an issue in the go-codec-dagpb dependency. Vulnerable nodes that work with these malformed graphs may crash leading to denial-of-service risks.
This particularly impacts nodes that download or export data that is controlled by external user input as there is the possibility that a malicious user of those services could (intentionally or unintentionally) cause the node to traverse a malformed graph. Some notable use cases include public gateways and pinning services which fetch data on behalf of users, as well as applications such as IPFS Companion which load data based on a user visiting a website with links to IPFS URLs.
Patches
Versions v0.11.1 and v0.12.2 both resolve this issue. This should make it easy to upgrade, even if you have not yet performed the v0.12.0 migration.
For those running on forked versions of go-ipfs or who are on v0.10.0 and are having trouble with the v0.11.0 breaking changes, simply updating the version of go-codec-dagpb you are using to >=v1.3.2 should resolve the issue.
Any users of libraries within the go-ipfs ecosystem, even if not the go-ipfs package or binary itself, may be affected and should upgrade their dependency on go-codec-dagpb. You can check if your Go module has a dependency on go-codec-dagpb by running a command such as go mod graph | grep go-codec-dagpb in your module root.
Workarounds
The best way to workaround this issue is to control exposure to any endpoints that allow for arbitrary IPLD traversals. This primarily includes the HTTP RPC API (https://docs.ipfs.io/reference/http/api ) and the Gateway API. If you are exposing those APIs, then do so within an environment where only trusted users and applications you control have access to it. You should be safe as long as your users and applications do not create malformed graphs, which should not happen using standard go-ipfs tooling.
If you previously had a more open access environment, then closing off access will only be sufficient if both of the following are true:
- The experimental GraphSync feature is disabled (https://github.com/ipfs/go-ipfs/blob/master/docs/experimental-features.md#graphsync)
- The only data being accessed is non-malformed data
References
See also the go-codec-dagpb security advisory.
For more information
If you have any questions or comments about this advisory:
- Ask in IPFS Discord #ipfs-chatter
- Open an issue in go-ipfs
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐹Go | github.com/ipld/go-ipfs | ≥ 0.12.0&&< 0.12.2 | 0.12.2 |
| 🐹Go | github.com/ipld/go-ipfs | all versions | 0.11.1 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/ipld/go-ipfs. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update github.com/ipld/go-ipfs to 0.12.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-mcq2-w56r-5w2w is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-mcq2-w56r-5w2w is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to GHSA-mcq2-w56r-5w2w. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-mcq2-w56r-5w2w in your dependencies?
O3 detects GHSA-mcq2-w56r-5w2w across Go dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.