id: GO-2023-1766
modules:
    - module: github.com/ipfs/go-libipfs
      versions:
        - fixed: 0.4.1
        - introduced: 0.5.0
        - fixed: 0.6.0
      vulnerable_at: 0.5.0
      packages:
        - package: github.com/ipfs/go-libipfs/bitswap/server
    - module: github.com/ipfs/go-bitswap
      versions:
        - fixed: 0.12.0
      vulnerable_at: 0.11.0
      packages:
        - package: github.com/ipfs/go-bitswap/server
summary: Denial of service from memory leak in github.com/ipfs/go-libipfs
description: |-
    An attacker can cause a Bitswap server to allocate and leak unbounded amounts of
    memory.
cves:
    - CVE-2023-25568
ghsas:
    - GHSA-m974-xj4j-7qv5
    - GHSA-q3j6-22wf-3jh9
references:
    - advisory: https://github.com/ipfs/go-libipfs/security/advisories/GHSA-m974-xj4j-7qv5
review_status: REVIEWED