Filecoin Pin: Unbounded DAG pinning can exhaust filecoin-pin server resources

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP service. In daemon deployments up to and including version 1.1.0, POST /pins in src/filecoin-pinning-server.ts checks a caller-supplied CID with CID.parse and passes it to pinStore.pin, but does not enforce request rate limits or per-user quotas. In src/filecoin-pin-store.ts, each pin independently schedules _processPinInBackground with setTimeout without a queue, semaphore or concurrency cap, then recursively traverses the full DAG using helia.pins.add(cid). The per-pin Helia/Bitswap node in src/create-pinning-helia.ts has no application-level byte, block or traversal-time limits. Blocks are written under carStoragePath by src/core/car/car-blockstore-base.ts and src/core/car/car-file-backend.ts, with stats.totalSize updated only after writing. An authenticated caller, or an anonymous caller when ALLOW_NO_AUTH=true, can submit large DAGs and exhaust disk, network, CPU, memory and libp2p resources, causing service degradation or host/process failure and leaving partial CAR files requiring recovery. The default localhost binding and token requirement reduce exposure. Because nodes have no bootstrap or mDNS configuration, a CID alone may not be fetchable, but caller-supplied origins can point to a reachable attacker-controlled libp2p source; concurrent requests accelerate resource pressure. Version 1.1.1 documents operational mitigations but does not implement the missing resource controls.

Etkilenen sürümler1 yazılım

Kaynaklar4 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…in-pin/security/advisories/GHSA-m5ph-mmg5-6w5h Diğer
• github.com/…ommit/8db22b47899deb78dadf415fc477cae4bd6e82c2 Diğer

Kayıt geçmişi

1. 30 Eki 2026 23:15Yayımlandı

İlgili açıklar

• 8,2 CVE-2026-58412Filecoin Pin: Fork bypass in the privileged GitHub Actions workflow
• 7,5 CVE-2026-63341Aedes has Uncaught Exception and Uncontrolled Resource Consumption
• 5,5 CVE-2026-62250LibreDWG: unbounded allocation in pre-R13 DWG entity decoding
• 5,5 CVE-2026-62254LibreDWG: excessive class-decoding reallocation in R13-R2000 DWG parsing
• 5,9 CVE-2026-62303Pistache: DoS via stack exhaustion in REST router path normalization (regex_replace on long slash runs)
• 6,3 CVE-2026-61848Crass: Non-ASCII characters cause superlinear CPU consumption