Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.9
CVE-2023-23626: go-bitfield may crash with invalid size input
CVE-2023-23626 · published 3 years ago
Summary
The go-bitfield library used in IPFS can stop working if it receives a size value that isn’t a multiple of eight or is negative. This can cause the application to crash when processing untrusted data. Upgrade to a newer version, or validate that the size is a multiple of eight before calling NewBitfield or FromBytes.
What to do
- Update github.com ipfs to version 1.1.0.
- Update protocol go-bitfield to version 1.1.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| go | github.com | ipfs |
< 1.1.0 Fix: upgrade to 1.1.0
|
| – | protocol | go-bitfield |
< 1.1.0 cpe:2.3:a:protocol:go-bitfield:*:*:*:*:*:go:*:* |
Original advisory text
Denial of service when feeding malformed size arguments in go-bitfield
go-bitfield is a simple bitfield package for the go language aiming to be more performant that the standard library. When feeding untrusted user input into the size parameter of `NewBitfield` and `FromBytes` functions, an attacker can trigger `panic`s. This happen when the `size` is a not a multiple of `8` or is negative. There were already a note in the `NewBitfield` documentation, however known users of this package are subject to this issue. Users are advised to upgrade. Users unable to upgrade should ensure that `size` is a multiple of 8 before calling `NewBitfield` or `FromBytes`.
References
- https://pkg.go.dev/vuln/GO-2023-1558
- https://github.com/advisories/GHSA-2h6c-j3gf-xp9r
- https://github.com/ipfs/go-bitfield/security/advisories/GHSA-2h6c-j3gf-xp9r Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-23626 Vendor Advisory
- https://github.com/ipfs/go-bitfield/commit/5e1d256fe043fc4163343ccca83862c69c52e... Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/23xxx/CVE-2023-23626... Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-754Improper Check for Unusual or Exceptional Conditions
CWE-1284Improper Validation of Specified Quantity in Input
Timeline
Published9 Feb 2023
Updated3 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta