GitHub Advisoryadvisory · npm

GHSA-6fcr-9h9g-23fq Denial of Service in ipfs-bitswap

MEDIUM Published 2020-09-02 Modified 2023-12-07 Official page ↗
Ecosystem
npm
Packages
ipfs-bitswap
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2020-08-31

Affected packages

• npm ipfs-bitswap: < 0.24.1 → fixed in 0.24.1

Description

Versions of `ipfs-bitswap` prior to 0.24.1 are vulnerable to Denial of Service (DoS). The package put unwanted blocks in the blockstore, which could be used to exhaust system resources in specific conditions. Recommendation Upgrade to version 0.24.1 or later.

Related

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References