VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/ipfs/go-libipfs: vulnerability history, versions and safety

github.com/ipfs/go-libipfs is a package in the Go ecosystem. Vulert records 3 vulnerabilities for it across 120 releases, from May 2023 to Jun 2023. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
3 vulnerabilities recorded H1 U2
i
0 with no fix published

Every vulnerability has a patched version to move to.

i
0 in the last 12 months

Nothing new recorded in the last year.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/ipfs/go-libipfs vulnerabilities

Vulert verdict on github.com/ipfs/go-libipfs v0.7.0 i

Updated on 23 Oct 2026

Action needed: v0.7.0 has 2 known vulnerabilities, but every one of them has a fix. Upgrade to the version listed below and you are clear.

Package health score 61/100
  • Security No known security issues
  • Maintenance Maintaining
  • Popularity Little adoption
  • Community Inactive

What to do: Upgrade to the version that resolves each vulnerability below. Fix it, then keep watch: this version is affected today, and the next one may be too — Vulert alerts you when a new vulnerability lands. Monitor it with Vulert →

  • Current release v0.7.0 — affected i
  • Vulnerabilities on record 3 over 1 year · 0 in the last year i
  • Latest disclosure 14 Jun 2023 i
  • Highest CVSS 8.2 i
  • With no published fix 0 i
  • Last release 43 months ago i
  • Licence Apache-2.0 i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/ipfs/go-libipfs, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v0.7.1-0.20230323215740-b3c7bf16c603 23 Mar 2023 U2 Apache-2.0 Yes Details →
v0.6.1-0.20230323200757-2ee048b4b5df 23 Mar 2023 U2 Apache-2.0 Yes Details →
v0.6.1-0.20230323074257-323183967d08 23 Mar 2023 U2 Apache-2.0 Yes Details →
v0.7.1-0.20230321154728-1c4716f9e834 21 Mar 2023 U2 Apache-2.0 Yes Details →
v0.7.1-0.20230321095852-784eed6e63ff 21 Mar 2023 U2 Apache-2.0 Yes Details →
v0.6.3-0.20230320124707-517c64d18ad0 20 Mar 2023 U2 Apache-2.0 Yes Details →
v0.7.0 20 Mar 2023 U2 Apache-2.0 Yes Details →
v0.6.3-0.20230320100319-38815514df3b 20 Mar 2023 U2 Apache-2.0 Yes Details →
v0.6.2-0.20230320083405-26fc7c0025ac 20 Mar 2023 U2 Apache-2.0 Yes Details →
v0.6.3-0.20230319151954-4a1cb78cbf39 19 Mar 2023 U2 Apache-2.0 Yes Details →
v0.6.2 16 Mar 2023 U2 Apache-2.0 Yes Details →
v0.6.2-0.20230316155614-e45eb146ba11 16 Mar 2023 U2 Apache-2.0 Yes Details →
v0.6.2-0.20230316102252-c3d7b6fc0a8c 16 Mar 2023 U2 Apache-2.0 Yes Details →
v0.6.2-0.20230315163110-0af8279544a8 15 Mar 2023 U2 Apache-2.0 Yes Details →
v0.6.2-0.20230315162035-bcda64b0f9b8 15 Mar 2023 U2 Apache-2.0 Yes Details →
v0.6.2-0.20230315152154-332cbe486021 15 Mar 2023 U2 Apache-2.0 Yes Details →
v0.6.2-0.20230315110647-5f7a83313f98 15 Mar 2023 U2 Apache-2.0 Yes Details →
v0.6.2-0.20230314153442-124ae4b3a578 14 Mar 2023 U2 Apache-2.0 Yes Details →
v0.6.2-0.20230314140458-ae65e02379d4 14 Mar 2023 U2 Apache-2.0 Yes Details →
v0.6.2-0.20230314105346-2eb8fb694a8f 14 Mar 2023 U2 Apache-2.0 Yes Details →
v0.6.2-0.20230313163807-0a723380b1b5 13 Mar 2023 U2 Apache-2.0 Yes Details →
v0.6.2-0.20230310100845-c9bed986de5b 10 Mar 2023 U2 Apache-2.0 Yes Details →
v0.6.2-0.20230309112742-261546757a0f 09 Mar 2023 U2 Apache-2.0 Yes Details →
v0.6.2-0.20230309103450-2411c38dc5dc 09 Mar 2023 U2 Apache-2.0 Yes Details →
v0.6.2-0.20230309100404-db8b79eb52d9 09 Mar 2023 U2 Apache-2.0 Yes Details →
v0.6.2-0.20230309095205-cde04e59712b 09 Mar 2023 U2 Apache-2.0 Yes Details →
v0.6.1-0.20230309094150-54d1bfae7879 09 Mar 2023 U2 Apache-2.0 Yes Details →
v0.6.1-0.20230309092406-f1f1bde37453 09 Mar 2023 U2 Apache-2.0 Yes Details →
v0.6.1-0.20230309091211-11301123d9bd 09 Mar 2023 U2 Apache-2.0 Yes Details →
v0.6.1 07 Mar 2023 U2 Apache-2.0 Yes Details →
v0.6.1-0.20230307155440-17f8d7098414 07 Mar 2023 U2 Apache-2.0 Yes Details →
v0.6.1-0.20230307110602-8c1c4d026377 07 Mar 2023 U2 Apache-2.0 Yes Details →
v0.6.1-0.20230306184940-4a49a38e3b61 06 Mar 2023 U2 Apache-2.0 Yes Details →
v0.0.0-20230306084414-15f2131fe190 06 Mar 2023 U2 Apache-2.0 Yes Details →
v0.6.1-0.20230306084414-15f2131fe190 06 Mar 2023 U2 Apache-2.0 Yes Details →
v0.6.1-0.20230306034211-49716dcef2e2 06 Mar 2023 U2 Apache-2.0 Yes Details →
v0.6.1-0.20230305054501-7af0fc6e1ec3 05 Mar 2023 U2 Apache-2.0 Yes Details →
v0.6.1-0.20230305053938-7275da3f57bf 05 Mar 2023 U2 Apache-2.0 Yes Details →
v0.6.1-0.20230305040441-61f233c8e746 05 Mar 2023 U2 Apache-2.0 Yes Details →
v0.6.1-0.20230305035831-292516a1290c 05 Mar 2023 U2 Apache-2.0 Yes Details →
v0.6.1-0.20230305015441-b4a6bb7bc6f2 05 Mar 2023 U2 Apache-2.0 Yes Details →
v0.6.1-0.20230303101737-7af2b2b4d21c 03 Mar 2023 U2 Apache-2.0 Yes Details →
v0.6.1-0.20230303072813-d8aae0df1409 03 Mar 2023 U2 Apache-2.0 Yes Details →
v0.6.1-0.20230301084047-3f135ce0da51 01 Mar 2023 U2 Apache-2.0 Yes Details →
v0.6.1-0.20230301081913-2631a5c17b7d 01 Mar 2023 U2 Apache-2.0 Yes Details →
v0.6.1-0.20230301073600-2bba208ace1d 01 Mar 2023 U2 Apache-2.0 Yes Details →
v0.6.1-0.20230301071044-8fca1aedaeec 01 Mar 2023 U2 Apache-2.0 Yes Details →
v0.0.0-20230228004237-36918f45f260 28 Feb 2023 U2 Apache-2.0 Yes Details →
v0.6.1-0.20230228004237-36918f45f260 28 Feb 2023 U2 Apache-2.0 Yes Details →
v0.6.1-0.20230227100804-8108c45eae7d 27 Feb 2023 U2 Apache-2.0 Yes Details →
v0.6.1-0.20230227095311-b9c39ea135be 27 Feb 2023 U2 Apache-2.0 Yes Details →
v0.6.1-0.20230227083629-0d5d1ca6e251 27 Feb 2023 U2 Apache-2.0 Yes Details →
v0.0.0-20230224152609-00e024995173 24 Feb 2023 U2 Apache-2.0 Yes Details →
v0.6.1-0.20230224152609-00e024995173 24 Feb 2023 U2 Apache-2.0 Yes Details →
v0.6.1-0.20230224151528-c08d8f7b7501 24 Feb 2023 U2 Apache-2.0 Yes Details →
v0.0.0-20230224134131-7ba1df55d53b 24 Feb 2023 U2 Apache-2.0 Yes Details →
v0.6.1-0.20230224134131-7ba1df55d53b 24 Feb 2023 U2 Apache-2.0 Yes Details →
v0.6.1-0.20230224104611-b940fa696966 24 Feb 2023 U2 Apache-2.0 Yes Details →
v0.6.1-0.20230224104125-c33d9fea19c2 24 Feb 2023 U2 Apache-2.0 Yes Details →
v0.6.1-0.20230223163018-88f007fd6959 23 Feb 2023 U2 Apache-2.0 Yes Details →
v0.6.1-0.20230223125313-3a9600656155 23 Feb 2023 U2 Apache-2.0 Yes Details →
v0.6.1-0.20230223074304-6c0f842feed4 23 Feb 2023 U2 Apache-2.0 Yes Details →
v0.6.1-0.20230222155454-330d06ac5418 22 Feb 2023 U2 Apache-2.0 Yes Details →
v0.6.1-0.20230222132409-30f26b33249e 22 Feb 2023 U2 Apache-2.0 Yes Details →
v0.0.0-20230222011044-7b201415a176 22 Feb 2023 U2 Apache-2.0 Yes Details →
v0.6.1-0.20230222011044-7b201415a176 22 Feb 2023 U2 Apache-2.0 Yes Details →
v0.6.1-0.20230221102038-5aceeb994f1c 21 Feb 2023 U2 Apache-2.0 Yes Details →
v0.6.1-0.20230220081646-77fb1942d765 20 Feb 2023 U2 Apache-2.0 Yes Details →
v0.6.1-0.20230217173650-c394290eebc4 17 Feb 2023 U2 Apache-2.0 Yes Details →
v0.4.1 17 Feb 2023 U2 Apache-2.0 Yes Details →
v0.4.1-0.20230217171433-c8438803571d 17 Feb 2023 U2 Apache-2.0 Yes Details →
v0.4.1-0.20230217171431-35144c1e0577 17 Feb 2023 U2 Apache-2.0 Yes Details →
v0.0.0-20230217170635-8c3191052015 17 Feb 2023 U2 Apache-2.0 Yes Details →
v0.5.1-0.20230217170635-62cbac40b96f 17 Feb 2023 U2 Apache-2.0 Yes Details →
v0.5.1-0.20230217170635-9cb5cb54d40b 17 Feb 2023 U2 Apache-2.0 Yes Details →
v0.5.1-0.20230217170635-baa748b682fa 17 Feb 2023 U2 Apache-2.0 Yes Details →
v0.6.0 17 Feb 2023 U2 Apache-2.0 Yes Details →
v0.5.1-0.20230215140124-d195f6d37ba4 15 Feb 2023 U2 Apache-2.0 Yes Details →
v0.5.1-0.20230215072830-87e8bc6d7cd9 15 Feb 2023 U2 Apache-2.0 Yes Details →
v0.0.0-20230215002322-e7aa6a184deb 15 Feb 2023 U2 Apache-2.0 Yes Details →
v0.5.1-0.20230215002322-e7aa6a184deb 15 Feb 2023 U2 Apache-2.0 Yes Details →
v0.5.1-0.20230213112158-415d56ab16cb 13 Feb 2023 U2 Apache-2.0 Yes Details →
v0.5.1-0.20230210211110-c76138366f1a 10 Feb 2023 U2 Apache-2.0 Yes Details →
v0.0.0-20230210165858-0d695f323e00 10 Feb 2023 U2 Apache-2.0 Yes Details →
v0.5.0 10 Feb 2023 U2 Apache-2.0 Yes Details →
v0.0.0-20230210132922-6e23bc24bd8f 10 Feb 2023 U2 MIT Yes Details →
v0.0.0-20230209225807-1c6ed2e96f77 09 Feb 2023 U2 Apache-2.0 Yes Details →
v0.4.1-0.20230209225807-1c6ed2e96f77 09 Feb 2023 U2 Apache-2.0 Yes Details →
v0.4.1-0.20230208030004-93dd0a02a18b 08 Feb 2023 U2 Apache-2.0 Yes Details →
v0.4.1-0.20230208022905-378aaf777cf9 08 Feb 2023 U2 Apache-2.0 Yes Details →
v0.4.1-0.20230207100523-8fcb67e525b7 07 Feb 2023 U2 Apache-2.0 Yes Details →
v0.4.1-0.20230207021459-1a932f7bb3c1 07 Feb 2023 U2 Apache-2.0 Yes Details →
v0.4.1-0.20230206093736-276ccbab8543 06 Feb 2023 U2 Apache-2.0 Yes Details →
v0.4.1-0.20230206084804-a4e09342261d 06 Feb 2023 U2 Apache-2.0 Yes Details →
v0.4.1-0.20230203104224-13b6f58f2846 03 Feb 2023 U2 Apache-2.0 Yes Details →
v0.4.1-0.20230203091331-b6adbccef49a 03 Feb 2023 U2 Apache-2.0 Yes Details →
v0.4.1-0.20230202151652-c091fd659bc6 02 Feb 2023 U2 Apache-2.0 Yes Details →
v0.4.1-0.20230202091244-302b2799386d 02 Feb 2023 U2 Apache-2.0 Yes Details →
v0.4.1-0.20230202010411-6399b73f974c 02 Feb 2023 U2 Apache-2.0 Yes Details →
v0.4.1-0.20230201214832-687c0b0f1531 01 Feb 2023 U2 Apache-2.0 Yes Details →
v0.4.1-0.20230201110556-c7cc8b8c1ed4 01 Feb 2023 U2 — Yes Details →
v0.4.1-0.20230201092047-7d5dc77a0a5f 01 Feb 2023 U2 — Yes Details →
v0.4.1-0.20230201090437-7c4486878970 01 Feb 2023 U2 — Yes Details →
v0.4.1-0.20230201082329-1e462b639ca3 01 Feb 2023 U2 — Yes Details →
v0.4.1-0.20230131164115-b4a01af26d08 31 Jan 2023 U2 — Yes Details →
v0.4.1-0.20230131160618-71f5952fd6f4 31 Jan 2023 U2 — Yes Details →
v0.4.1-0.20230131113959-d5b45ee1d11d 31 Jan 2023 U2 — Yes Details →
v0.4.1-0.20230131104030-73465059ab96 31 Jan 2023 U2 — Yes Details →
v0.4.1-0.20230130233950-a005a5006496 30 Jan 2023 U2 — Yes Details →
v0.4.1-0.20230130114645-a059026dbd0a 30 Jan 2023 U2 — Yes Details →
v0.4.0 27 Jan 2023 U2 — Yes Details →
v0.3.1-0.20230127212737-3080787406cf 27 Jan 2023 U2 — Yes Details →
v0.3.1-0.20230127135653-cc954f1b0e17 27 Jan 2023 U2 — Yes Details →
v0.3.1-0.20230127121942-acff5bf86b0f 27 Jan 2023 U2 — Yes Details →
v0.3.1-0.20230127103140-538a8a8a82bc 27 Jan 2023 U2 — Yes Details →
v0.3.1-0.20230127101911-a96c2a9fc6b0 27 Jan 2023 U2 — Yes Details →
v0.3.1-0.20230127101331-8cdf62320c35 27 Jan 2023 U2 — Yes Details →
v0.3.1-0.20230127100948-3ce4c7b843f3 27 Jan 2023 U2 — Yes Details →
v0.3.1-0.20230127095008-e047905327b8 27 Jan 2023 U2 — Yes Details →
v0.3.0 26 Jan 2023 U2 — Yes Details →

The newest 120 of 152 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2023 3

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 0 of the 3 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/ipfs/go-libipfs

The 3 most severe of 3 vulnerabilities recorded for this package

Search all 3 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2023-25568: Open Source Vulnerability in github.com/ipfs/go-libipfs 8.2 high 0.6.0 11 May 2023
CVE-2023-25568: Boxo bitswap/server: DOS unbounded persistent memory leak N/A unrated 0.4.1 14 Jun 2023
CVE-2023-25568: Denial of Service from Memory Leak in github.com/ipfs/go-libipfs N/A unrated 0.4.1 14 Jun 2023

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/ipfs/go-libipfs

Is github.com/ipfs/go-libipfs safe to use?

Vulert records 3 vulnerabilities for github.com/ipfs/go-libipfs in Go: 0 critical, 1 high, 0 medium and 0 low, plus 2 not yet rated. Every one of them has a published fix, so the practical answer is to run a supported release and keep it patched.

What is github.com/ipfs/go-libipfs's Vulert package health score?

Vulert scores github.com/ipfs/go-libipfs 61/100, which reads as usable, but worth attention. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15).

Is the latest version of github.com/ipfs/go-libipfs affected?

Yes. v0.7.0, the version you would install today, has 2 known vulnerabilities, and every one of them has a published fix. Upgrade to the version listed for each.

Which version of github.com/ipfs/go-libipfs should I use?

v0.7.0 is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.

How many vulnerabilities does github.com/ipfs/go-libipfs have?

3 vulnerabilities are recorded for github.com/ipfs/go-libipfs in the Go ecosystem: 0 critical, 1 high, 0 medium and 0 low, plus 2 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/ipfs/go-libipfs vulnerabilities disclosed?

0 vulnerabilities were recorded for github.com/ipfs/go-libipfs in the last 12 months, and the oldest entry in this database dates to 11 May 2023. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/ipfs/go-libipfs are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/ipfs/go-libipfs for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/ipfs/go-libipfs version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.