What is CVE-2023-25568?

CVE-2023-25568 is a high-severity uncontrolled resource consumption vulnerability in github.com/ipfs/go-libipfs (go), affecting versions >= 0.5.0, < 0.6.0. It is fixed in 0.6.0, 0.4.1. Crafted input forces the application to consume excessive CPU, memory, or other resources, degrading or denying service.

How severe is CVE-2023-25568?

CVE-2023-25568 has a CVSS score of 8.2 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.

Which versions of github.com/ipfs/go-libipfs are affected by CVE-2023-25568?

github.com/ipfs/go-libipfs (go) versions >= 0.5.0, < 0.6.0 is affected.

Is there a fix for CVE-2023-25568?

Yes. CVE-2023-25568 is fixed in 0.6.0, 0.4.1. Upgrade to this version or later.

Is CVE-2023-25568 exploitable, and should I be worried?

Whether CVE-2023-25568 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

What actually determines whether CVE-2023-25568 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

How do I fix CVE-2023-25568?

Upgrade: github.com/ipfs/go-libipfs to 0.6.0 or later, github.com/ipfs/go-libipfs to 0.4.1 or later.

CVE-2023-25568 in github.com/ipfs/go-libipfs

Q: How severe is CVE-2023-25568?

CVE-2023-25568 has a CVSS score of 8.2 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.

Q: Which versions of github.com/ipfs/go-libipfs are affected by CVE-2023-25568?

github.com/ipfs/go-libipfs (go) versions >= 0.5.0, < 0.6.0 is affected.

Q: Is there a fix for CVE-2023-25568?

Yes. CVE-2023-25568 is fixed in 0.6.0, 0.4.1. Upgrade to this version or later.

Q: Is CVE-2023-25568 exploitable, and should I be worried?

Whether CVE-2023-25568 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

Q: What actually determines whether CVE-2023-25568 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

Q: How do I fix CVE-2023-25568?

Upgrade: github.com/ipfs/go-libipfs to 0.6.0 or later, github.com/ipfs/go-libipfs to 0.4.1 or later.

Summary

Boxo bitswap/server: DOS unbounded persistent memory leak

Mitigations

The server now limits how many wantlist entries per peer it knows.
The MaxQueuedWantlistEntriesPerPeer option allows configuring how many wantlist entries the server remembers; if a peer sends a wantlist bigger than this (including a sum of multiple delta updates) the server will truncate the wantlist to the match the limit.
This defaults to 1024 entries per peer.
The server now properly clears state about peers when they disconnect.
Peer state is more lazily allocated (only when a wantlist is received in the first place) and is properly cleared when the PeerDisconnected callback is received.
The server now ignores CIDs above some size.
Clients were able to send any CID as long as the total protobuf message were bellow the 4MiB limit. This is allowed to allocate lots of memory with very little entries.
This can be configured using the MaxCidSize option and defaults to 168 bytes.
The server now closes the connection if an inline CID is requested (either as WANT_* or CANCEL).
The attack were more effective if done with CIDs that are present in target's blockstore, this is because this will push longer-lasting jobs on some priority queue.
Since inline CID are literal data (instead of hashes of data), everyone always "has" any inline CID (since instead of loading the data from disk, it can be extracted from the CID). It makes no sense for anyone to ever ask you about an inline CID since they could also just parse it themselves. Thus, as a defensive measure, we kill the connection with peers that ask about an inline CID.

Vulnerable symbols

github.com/ipfs/go-libipfs/bitswap/server/internal/decision.(*Engine).MessageReceived
github.com/ipfs/go-libipfs/bitswap/server/internal/decision.(*Engine).NotifyNewBlocks
github.com/ipfs/go-libipfs/bitswap/server/internal/decision.(*Engine).findOrCreate
github.com/ipfs/go-libipfs/bitswap/server/internal/decision.(*Engine).PeerConnected

Patches

https://github.com/ipfs/boxo/commit/9cb5cb54d40b57084d1221ba83b9e6bb3fcc3197 (mitigations 1 and 2)
https://github.com/ipfs/boxo/commit/62cbac40b96f49e39cd7fedc77ee6b56adce4916 (mitigations 3 and 4)
https://github.com/ipfs/boxo/commit/baa748b682fabb21a4c1f7628a8af348d4645974 (tests)

Workarounds

If you are using the stubs at github.com/ipfs/go-libipfs/bitswap and not taking advantage of the features provided by the server, refactoring your code to use the new split API will allow you to run in a client-only mode using: github.com/ipfs/boxo/bitswap/client.

Impact

An attacker is able allocate arbitrarily many bytes in the Bitswap server by sending many WANT_BLOCK and or WANT_HAVE requests which are queued in an unbounded queue, with allocations that persist even if the connection is closed.
This affects users accepting untrusted connections with the Bitswap server, this also affects users using the old API stubs at github.com/ipfs/boxo/bitswap because it transitively uses github.com/ipfs/boxo/bitswap/server.

We have renamed go-libipfs to boxo; this document uses both terms interchangeably. The version numbers for both are applicable, as they share the same historical timeline.

Crafted input forces the application to consume excessive CPU, memory, or other resources, degrading or denying service. Typical impact: denial of service.

CVE-2023-25568 has a CVSS score of 8.2 (High). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.6.0, 0.4.1); upgrading removes the vulnerable code path.

Affected versions

github.com/ipfs/go-libipfs (>= 0.5.0, < 0.6.0) github.com/ipfs/go-libipfs (< 0.4.1)

Security releases

github.com/ipfs/go-libipfs → 0.6.0 (go) github.com/ipfs/go-libipfs → 0.4.1 (go)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environment New to Kodem? Get a demo →

Remediation advice

Apply one of:

Update boxo to v0.6.0 or later
Update boxo to v0.4.1
Note that v0.5.0 is NOT safe, v0.4.1 is a backport of the v0.6.0 security fixes on top of v0.4.0.

Frequently Asked Questions

What is CVE-2023-25568? CVE-2023-25568 is a high-severity uncontrolled resource consumption vulnerability in github.com/ipfs/go-libipfs (go), affecting versions >= 0.5.0, < 0.6.0. It is fixed in 0.6.0, 0.4.1. Crafted input forces the application to consume excessive CPU, memory, or other resources, degrading or denying service.
How severe is CVE-2023-25568? CVE-2023-25568 has a CVSS score of 8.2 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
Which versions of github.com/ipfs/go-libipfs are affected by CVE-2023-25568? github.com/ipfs/go-libipfs (go) versions >= 0.5.0, < 0.6.0 is affected.
Is there a fix for CVE-2023-25568? Yes. CVE-2023-25568 is fixed in 0.6.0, 0.4.1. Upgrade to this version or later.
Is CVE-2023-25568 exploitable, and should I be worried? Whether CVE-2023-25568 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
What actually determines whether CVE-2023-25568 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
How do I fix CVE-2023-25568?
- Upgrade github.com/ipfs/go-libipfs to 0.6.0 or later
- Upgrade github.com/ipfs/go-libipfs to 0.4.1 or later