CVE-2023-25568

Boxo, formerly known as go-libipfs, is a library for building IPFS applications and implementations. In versions 0.4.0 and 0.5.0, if an attacker is able allocate arbitrary many bytes in the Bitswap server, those allocations are lasting even if the connection is closed. This affects users accepting untrusted connections with the Bitswap server and also affects users using the old API stubs at `github.com/ipfs/go-libipfs/bitswap` because users then transitively import `github.com/ipfs/go-libipfs/bitswap/server`. Boxo versions 0.6.0 and 0.4.1 contain a patch for this issue. As a workaround, those who are using the stub object at `github.com/ipfs/go-libipfs/bitswap` not taking advantage of the features provided by the server can refactor their code to use the new split API that will allow them to run in a client only mode: `github.com/ipfs/go-libipfs/bitswap/client`.

• CWE-400
• CWE-770
• CWE-770

• https://github.com/ipfs/boxo/commit/62cbac40b96f49e39cd7fedc77ee6b56adce4916Patch
• https://github.com/ipfs/boxo/commit/9cb5cb54d40b57084d1221ba83b9e6bb3fcc3197Patch
• https://github.com/ipfs/boxo/commit/baa748b682fabb21a4c1f7628a8af348d4645974Patch
• https://github.com/ipfs/go-libipfs/security/advisories/GHSA-m974-xj4j-7qv5Mitigation, Patch, Vendor Advisory
• https://github.com/ipfs/boxo/commit/62cbac40b96f49e39cd7fedc77ee6b56adce4916Patch
• https://github.com/ipfs/boxo/commit/9cb5cb54d40b57084d1221ba83b9e6bb3fcc3197Patch
• https://github.com/ipfs/boxo/commit/baa748b682fabb21a4c1f7628a8af348d4645974Patch
• https://github.com/ipfs/go-libipfs/security/advisories/GHSA-m974-xj4j-7qv5Mitigation, Patch, Vendor Advisory

Published

May 10, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-25562DataHub is an open-source metadata platform. In versions of …9.8
• CVE-2023-25563GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that…7.5
• CVE-2023-25564GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that…8.2
• CVE-2023-25565GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that…7.5
• CVE-2023-25566GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that…7.5
• CVE-2023-25567GSS-NTLMSSP, a mechglue plugin for the GSSAPI library that i…7.5
• CVE-2023-25569Apollo is a configuration management system. Prior to versio…5.7
• CVE-2023-2557The WPCS – WordPress Currency Switcher Professional plugin f…4.3
• CVE-2023-25570Apollo is a configuration management system. Prior to versio…7.5
• CVE-2023-25571Backstage is an open platform for building developer portals…5.4
• CVE-2023-25572react-admin is a frontend framework for building browser app…5.4
• CVE-2023-25573metersphere is an open source continuous testing platform. I…7.5