CVE-2026-62300: filecoin-pin: Unbounded DAG pinning can exhaust server resources
The IPFS Pinning Service API implementation accepts a caller-controlled CID through POST /pins, queues background processing, and then recursively fetches the full DAG with helia.pins.add(cid). The route and background pinning path do not enforce a request rate limit, per-user quota, maximum DAG byte count, maximum block count, traversal timeout, or concurrent pinning limit.
An authenticated caller, or an unauthenticated caller when the server is started with ALLOW_NO_AUTH=true, can submit one or more pins whose CIDs resolve to very large DAGs. The server writes fetched blocks to CAR files under carStoragePath and can consume disk, network, CPU, and libp2p resources until the process or host becomes unavailable.
References
- github.com/advisories/GHSA-m5ph-mmg5-6w5h
- github.com/filecoin-project/filecoin-pin/commit/8db22b47899deb78dadf415fc477cae4bd6e82c2
- github.com/filecoin-project/filecoin-pin/commit/afa019307db23a703737675e94316edcc6572050
- github.com/filecoin-project/filecoin-pin/releases/tag/v1.1.1
- github.com/filecoin-project/filecoin-pin/security/advisories/GHSA-m5ph-mmg5-6w5h
- nvd.nist.gov/vuln/detail/CVE-2026-62300
Code Behaviors & Features
Detect and mitigate CVE-2026-62300 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →