Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
ipfs/boxo
main @ 60d59d5
83
Fixes
0
CVEs
HIGH
Peak severity
46.4%
Coverage
Highlights
Denial of Service: 60 prior fixes. Scrutinize any change in this area.
gateway/core/corehttp: most-fixed (7 issues). Treat as high-risk during review.
26 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Denial of Service: Unbounded growth of wantlists and session tracking structures previously led to severe memory leaks. Proper cancellation propagation and deleting structures upon request cleanup are necessary to prevent peer-induced resource exhaustion.
Path Traversal: Tar extraction path parsing and symlink resolution did not enforce prefix validation or canonicalization, allowing archives with traversing path components or malicious symlinks to write files outside of target directories.
Auth Bypass: Failure to restrict Service Worker registrations on namespace roots allowed attackers to register malicious service workers, facilitating origin takeovers and script injection on shared IPFS gateways.