What is GHSA-MCQ2-W56R-5W2W?

GHSA-MCQ2-W56R-5W2W is a high-severity security vulnerability in github.com/ipld/go-ipfs (go), affecting versions >= 0.12.0, < 0.12.2. It is fixed in 0.12.2, 0.11.1.

Which versions of github.com/ipld/go-ipfs are affected by GHSA-MCQ2-W56R-5W2W?

github.com/ipld/go-ipfs (go) versions >= 0.12.0, < 0.12.2 is affected.

Is there a fix for GHSA-MCQ2-W56R-5W2W?

Yes. GHSA-MCQ2-W56R-5W2W is fixed in 0.12.2, 0.11.1. Upgrade to this version or later.

Is GHSA-MCQ2-W56R-5W2W exploitable, and should I be worried?

Whether GHSA-MCQ2-W56R-5W2W is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

What actually determines whether GHSA-MCQ2-W56R-5W2W is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

How do I fix GHSA-MCQ2-W56R-5W2W?

Upgrade: github.com/ipld/go-ipfs to 0.12.2 or later, github.com/ipld/go-ipfs to 0.11.1 or later.

GHSA-MCQ2-W56R-5W2W in github.com/ipld/go-ipfs

Q: Which versions of github.com/ipld/go-ipfs are affected by GHSA-MCQ2-W56R-5W2W?

github.com/ipld/go-ipfs (go) versions >= 0.12.0, < 0.12.2 is affected.

Q: Is there a fix for GHSA-MCQ2-W56R-5W2W?

Yes. GHSA-MCQ2-W56R-5W2W is fixed in 0.12.2, 0.11.1. Upgrade to this version or later.

Q: Is GHSA-MCQ2-W56R-5W2W exploitable, and should I be worried?

Whether GHSA-MCQ2-W56R-5W2W is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

Q: What actually determines whether GHSA-MCQ2-W56R-5W2W is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

Q: How do I fix GHSA-MCQ2-W56R-5W2W?

Upgrade: github.com/ipld/go-ipfs to 0.12.2 or later, github.com/ipld/go-ipfs to 0.11.1 or later.

Summary

Daemon panics when processing certain blocks

Workarounds

The best way to workaround this issue is to control exposure to any endpoints that allow for arbitrary IPLD traversals. This primarily includes the HTTP RPC API (https://docs.ipfs.io/reference/http/api ) and the Gateway API. If you are exposing those APIs, then do so within an environment where only trusted users and applications you control have access to it. You should be safe as long as your users and applications do not create malformed graphs, which should not happen using standard go-ipfs tooling.

If you previously had a more open access environment, then closing off access will only be sufficient if both of the following are true:

The experimental GraphSync feature is disabled (https://github.com/ipfs/go-ipfs/blob/master/docs/experimental-features.md#graphsync)
The only data being accessed is non-malformed data

References

See also the go-codec-dagpb security advisory.

For more information

If you have any questions or comments about this advisory:

Ask in IPFS Discord #ipfs-chatter
Open an issue in go-ipfs

Impact

go-ipfs nodes with versions 0.10.0, 0.11.0, 0.12.0, or 0.12.1 can crash when trying to traverse certain malformed graphs due to an issue in the go-codec-dagpb dependency. Vulnerable nodes that work with these malformed graphs may crash leading to denial-of-service risks.

This particularly impacts nodes that download or export data that is controlled by external user input as there is the possibility that a malicious user of those services could (intentionally or unintentionally) cause the node to traverse a malformed graph. Some notable use cases include public gateways and pinning services which fetch data on behalf of users, as well as applications such as IPFS Companion which load data based on a user visiting a website with links to IPFS URLs.

Affected versions

github.com/ipld/go-ipfs (>= 0.12.0, < 0.12.2) github.com/ipld/go-ipfs (< 0.11.1)

Security releases

github.com/ipld/go-ipfs → 0.12.2 (go) github.com/ipld/go-ipfs → 0.11.1 (go)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environment New to Kodem? Get a demo →

Remediation advice

Versions v0.11.1 and v0.12.2 both resolve this issue. This should make it easy to upgrade, even if you have not yet performed the v0.12.0 migration.

For those running on forked versions of go-ipfs or who are on v0.10.0 and are having trouble with the v0.11.0 breaking changes, simply updating the version of go-codec-dagpb you are using to >=v1.3.2 should resolve the issue.

Any users of libraries within the go-ipfs ecosystem, even if not the go-ipfs package or binary itself, may be affected and should upgrade their dependency on go-codec-dagpb. You can check if your Go module has a dependency on go-codec-dagpb by running a command such as go mod graph | grep go-codec-dagpb in your module root.

Frequently Asked Questions

What is GHSA-MCQ2-W56R-5W2W? GHSA-MCQ2-W56R-5W2W is a high-severity security vulnerability in github.com/ipld/go-ipfs (go), affecting versions >= 0.12.0, < 0.12.2. It is fixed in 0.12.2, 0.11.1.
Which versions of github.com/ipld/go-ipfs are affected by GHSA-MCQ2-W56R-5W2W? github.com/ipld/go-ipfs (go) versions >= 0.12.0, < 0.12.2 is affected.
Is there a fix for GHSA-MCQ2-W56R-5W2W? Yes. GHSA-MCQ2-W56R-5W2W is fixed in 0.12.2, 0.11.1. Upgrade to this version or later.
Is GHSA-MCQ2-W56R-5W2W exploitable, and should I be worried? Whether GHSA-MCQ2-W56R-5W2W is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
What actually determines whether GHSA-MCQ2-W56R-5W2W is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
How do I fix GHSA-MCQ2-W56R-5W2W?
- Upgrade github.com/ipld/go-ipfs to 0.12.2 or later
- Upgrade github.com/ipld/go-ipfs to 0.11.1 or later