CVE-2023-23625

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

go-unixfs is an implementation of a unix-like filesystem on top of an ipld merkledag. Trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are reading untrusted user input, an attacker can then trigger a panic. This is caused by bogus `fanout` parameter in the HAMT directory nodes. Users are advised to upgrade to version 0.4.3 to resolve this issue. Users unable to upgrade should not feed untrusted user data to the decoding functions.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published
Feb 9, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-236267.5go-bitfield is a simple bitfield package for the go language aiming to be more performant that the standard library. When feeding untrusted CVE-2023-236276.1Sanitize is an allowlist-based HTML and CSS sanitizer. Versions 5.0.0 and later, prior to 6.0.1, are vulnerable to Cross-site Scripting. WheCVE-2023-236284.1Metabase is an open source data analytics platform. Affected versions are subject to Exposure of Sensitive Information to an Unauthorized AcCVE-2023-236296.3Metabase is an open source data analytics platform. Affected versions are subject to Improper Privilege Management. As intended, recipients CVE-2023-23639.8A vulnerability, which was classified as critical, has been found in SourceCodester Resort Reservation System 1.0. This issue affects some uCVE-2023-236306.1Eta is an embedded JS templating engine that works inside Node, Deno, and the browser. XSS attack - anyone using the Express API is impactedCVE-2023-236317.5github.com/ipfs/go-unixfsnode is an ADL IPLD prime node that wraps go-codec-dagpb's implementation of protobuf to enable pathing. In versionCVE-2023-236327.8BeyondTrust Privileged Remote Access (PRA) versions 22.2.x to 22.4.x are vulnerable to a local authentication bypass. Attackers can exploit CVE-2023-236349.8SQL Injection vulnerability in Documize version 5.4.2, allows remote attackers to execute arbitrary code via the user parameter of the /api/CVE-2023-236355.4In Jellyfin 10.8.x through 10.8.3, the name of a collection is vulnerable to stored XSS. This allows an attacker to steal access tokens fromCVE-2023-236365.4In Jellyfin 10.8.x through 10.8.3, the name of a playlist is vulnerable to stored XSS. This allows an attacker to steal access tokens from tCVE-2023-236377.6IMPatienT before 1.5.2 allows stored XSS via onmouseover in certain text fields within a PATCH /modify_onto request to the ontology builder.