CVE-2023-26248

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-26248
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-26248.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-26248
Aliases
Downstream
CGA (60)
openSUSE (1)
Related
Published
2024-10-25T00:00:00Z
Modified
2026-10-21T02:49:32Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
[none]
Details

The Kademlia DHT (go-libp2p-kad-dht 0.20.0 and earlier) used in IPFS (0.18.1 and earlier) assigns routing information for content (i.e., information about who holds the content) to be stored by peers whose peer IDs have a small DHT distance from the content ID. This allows an attacker to censor content by generating many Sybil peers whose peer IDs have a small distance from the content ID, thus hijacking the content resolution process.

Database specific 
{
    "cna_assigner":  "mitre",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26248.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "last_affected":  "0.18.1"
                        }
                    ],
                    "source":  "DESCRIPTION"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/libp2p/go-libp2p-kad-dht

Affected ranges

Type
GIT
Repo
https://github.com/libp2p/go-libp2p-kad-dht
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
2b85cfc0b1e5372bb36cb3ed4c82321054b1f055
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "0.20.0"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}

Affected versions

gx/v1.*
gx/v1.1.0
gx/v1.1.1
gx/v1.2.0
gx/v2.*
gx/v2.0.0
gx/v2.0.1
gx/v2.0.2
gx/v2.0.3
gx/v2.2.0
gx/v2.3.0
gx/v2.3.1
gx/v2.3.2
gx/v2.3.3
gx/v2.4.0
gx/v2.4.1
gx/v2.4.10
gx/v2.4.11
gx/v2.4.12
gx/v2.4.13
gx/v2.4.14
gx/v2.4.15
gx/v2.4.16
gx/v2.4.17
gx/v2.4.18
gx/v2.4.19
gx/v2.4.2
gx/v2.4.22
gx/v2.4.23
gx/v2.4.3
gx/v2.4.4
gx/v2.4.5
gx/v2.4.6
gx/v2.4.7
gx/v2.4.8
gx/v2.4.9
gx/v2.5.0
gx/v2.5.11
gx/v2.5.14
gx/v2.5.8
gx/v3.*
gx/v3.0.0
gx/v3.0.1
gx/v3.0.11
gx/v3.0.12
gx/v3.0.13
gx/v3.0.14
gx/v3.0.15
gx/v3.0.16
gx/v3.0.2
gx/v3.0.4
gx/v3.0.5
gx/v3.0.7
gx/v3.0.8
gx/v3.0.9
gx/v4.*
gx/v4.0.0
gx/v4.0.1
gx/v4.2.1
gx/v4.2.2
gx/v4.2.3
gx/v4.2.4
gx/v4.2.5
gx/v4.2.6
gx/v4.2.7
gx/v4.3.1
gx/v4.3.2
gx/v4.3.4
gx/v4.3.5
gx/v4.3.6
gx/v4.3.7
gx/v4.3.8
gx/v4.3.9
gx/v4.4.0
gx/v4.4.10
gx/v4.4.11
gx/v4.4.12
gx/v4.4.2
gx/v4.4.20
gx/v4.4.3
gx/v4.4.4
gx/v4.4.5
gx/v4.4.6
gx/v4.4.7
gx/v4.4.8
gx/v4.4.9
gx/v5.*
gx/v5.0.0
v0.*
v0.0.1
v0.0.10
v0.0.11
v0.0.12
v0.0.13
v0.0.14
v0.0.2
v0.0.4
v0.0.5
v0.0.6
v0.0.7
v0.0.8
v0.0.9
v0.1.0
v0.1.1
v0.10.0
v0.11.0
v0.11.1
v0.12.0
v0.12.1
v0.12.2
v0.13.0
v0.13.1
v0.14.0
v0.15.0
v0.16.0
v0.17.0
v0.18.0
v0.19.0
v0.2.0
v0.2.1
v0.2.2
v0.20.0
v0.3.0
v0.3.1
v0.3.2
v0.4.0
v0.4.1
v0.5.0
v0.5.1
v0.5.2
v0.6.0
v0.6.1
v0.6.2
v0.7.0
v0.7.1
v0.7.10
v0.7.11
v0.7.12
v0.7.2
v0.7.3
v0.7.4
v0.7.5
v0.7.6
v0.7.7
v0.7.8
v0.7.9
v0.8.0
v0.8.1
v0.8.3
v0.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-26248.json"