Daemon panics when processing certain blocks

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

not scored

EPSS

No dated EPSS signal available.

As published by the source; long descriptions are shortened.

Impact go-ipfs nodes with versions 0.10.0, 0.11.0, 0.12.0, or 0.12.1 can crash when trying to traverse certain malformed graphs due to an issue in the go-codec-dagpb dependency. Vulnerable nodes that work with these malformed graphs may crash leading to denial-of-service risks. This particularly impacts nodes that download or export data that is controlled by external user input as there is the possibility that a malicious user of those services could (intentionally or unintentionally) cause the node to traverse a malformed graph. Some notable use cases include public gateways and pinning services which fetch data on behalf of users, as well as applications such as IPFS Companion which load data based on a user visiting a website with links to IPFS URLs. Patches Versions v0.11.1 and v0.12.2 both resolve this issue. This should make it easy to upgrade, even if you have not yet performed the v0.12.0 migration. For those running on forked versions of go-ipfs or who are on v0.10.0 and…

Published by the source

8 Apr 2022, 22:09 UTC

Last modified by the source

11 Jan 2023, 05:06 UTC

Source last checked

26 Oct 2026, 14:54 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-mcq2-w56r-5w2w

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: GHSA-mcq2-w56r-5w2w

Advisory: Daemon panics when processing certain blocks
IDs: GHSA-mcq2-w56r-5w2w
Record: https://patchnext.com/advisories/ghsa-mcq2-w56r-5w2w (revision 1, source checked 26 Oct 2026, 14:54 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Unrated
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: github.com/ipld/go-ipfs 0.12.2, 0.11.1. A vendor fix does not mean a deployment is fixed.

## Affected components
- Go github.com/ipld/go-ipfs: affected >= 0.12.0, < 0.12.2; < 0.11.1; fixed in 0.11.1, 0.12.2

## Suggested inspection (read-only)
- Go github.com/ipld/go-ipfs: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on github.com/ipld/go-ipfs.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-mcq2-w56r-5w2w (GitHub-reviewed advisory GHSA-mcq2-w56r-5w2w lists affected ranges: Go github.com/ipld/go-ipfs >=0.12.0 =0 <0.11.1)

Commands are suggestions: review each one before running it.