CVE-2026-62300 with a CVSS score of 6.5 is a resource exhaustion vulnerability in the filecoin-pin IPFS Pinning Service API implementation. The flaw occurs because the POST /pins endpoint and background pinning path accept caller-controlled CIDs, queue processing, and recursively fetch entire DAGs without enforcing request rate limits, per-user quotas, maximum DAG byte counts, maximum block counts, traversal timeouts, or concurrent pinning limits. An authenticated caller, or an unauthenticated caller when the server is started with ALLOW_NO_AUTH=true, can submit one or more pins referencing excessively large DAGs, optionally supplying attacker-controlled libp2p origins hosting large content. Each request schedules independent background processing, causing the server to store fetched blocks in CAR files and consume disk, network, CPU, memory, and libp2p resources. Successful exploitation can result in disk and network exhaustion, service degradation, process failure, and increased operational costs or manual recovery efforts.
We recommend you to update filecoin-pin to version 1.1.1 or later.[/subscribe_to_unlock_form]
CVE-2026-62300 with a CVSS score of 6.5 is a resource exhaustion vulnerability in the filecoin-pin IPFS Pinning Service API implementation. The flaw occurs because the POST /pins endpoint and background pinning path accept caller-controlled CIDs, queue processing, and recursively fetch entire DAGs without enforcing request rate limits, per-user quotas, maximum DAG byte counts, maximum block counts, traversal timeouts, or concurrent pinning limits. An authenticated caller, or an unauthenticated caller when the server is started with ALLOW_NO_AUTH=true, can submit one or more pins referencing excessively large DAGs, optionally supplying attacker-controlled libp2p origins hosting large content. Each request schedules independent background processing, causing the server to store fetched blocks in CAR files and consume disk, network, CPU, memory, and libp2p resources. Successful exploitation can result in disk and network exhaustion, service degradation, process failure, and increased operational costs or manual recovery efforts.
We recommend you to update filecoin-pin to version 1.1.1 or later.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]