Threats tagged 'ghsa-m5ph-mmg5-6w5h'

filecoin-pin versions prior to 1.1.1 have an unbounded DAG pinning vulnerability where the Pinning Service API accepts user-controlled CIDs without enforcing limits on request rate, DAG size, or concurrency. This allows an attacker with authenticated access, or unauthenticated if no-auth mode is enabled, to cause resource exhaustion by recursively fetching large DAGs. The impact includes disk, network, CPU, and memory exhaustion leading to service degradation or failure. The default configuration limits exposure by binding to localhost and requiring an access token unless explicitly disabled. A fix is available in version 1.1.1.