Advisory Database
  • Advisories
  • Dependency Scanning
  1. golang
  2. ›
  3. github.com/ipld/go-car/v2
  4. ›
  5. GMS-2022-2940

GMS-2022-2940: Malformed CAR panics and excessive memory usage

July 6, 2022 (updated February 14, 2023)

Out of bound memory access (OOB), out of memory (OOM) panics or excessive memory usage can be triggered by decode of malformed CARv1 headers, malformed CARv1 sections, and malformed CIDv0 data used in CARv1 sections. This also applies to CARv1 data within a CARv2 container. Additionally, we wish to use this security advisory to make clear to consumers of CARv2 format data that loading CARv2 indexes from untrusted sources is dangerous and should be avoided. Where CAR data indexes are required, they should be regenerated locally. Out of memory (OOM) panics or excessive memory usage can be triggered by decode of intentionally malformed CARv2 indexes, or CARv2 indexes which are larger than available system memory (i.e. parallelization of CARv2 decodes may increase such a vulnerability).

References

  • github.com/advisories/GHSA-9x4h-8wgm-8xfg
  • github.com/ipld/go-car/security/advisories/GHSA-9x4h-8wgm-8xfg

Code Behaviors & Features

Detect and mitigate GMS-2022-2940 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions starting from 2.0.0 before 2.4.0

Fixed versions

  • v2.4.0

Solution

Upgrade to version 2.4.0 or above.

Source file

go/github.com/ipld/go-car/v2/GMS-2022-2940.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 14 May 2025 12:15:01 +0000.