Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-62300— Filecoin Pin: Unbounded DAG pinning can exhaust filecoin-pin server resources

Quick assessment

Affected
filecoin-project filecoin-pin
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Filecoin Pin 是一个 IPFS 固定服务（Pinning Service）的 API 实现，用于将内容固定到 Filecoin 的 PDP 服务中。在版本 1.1.0 及更早的守护进程部署中， 文件中的 接口会使用 对调用方提供的 CID 进行解析，并将其传递给 ，但该接口并未实施请求速率限制或每用户配额控制。 在 中，每个固定操作都会独立地通过 调度 方法执行，未使用队列、信号量或并发上限进行控制。随后，该方法会递归遍历整个有向无环图（DAG），调用 。在 中，为每个固定操作创建的 Helia/Bit

CVSS 6.5 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-62300

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Filecoin Pin: Unbounded DAG pinning can exhaust filecoin-pin server resources
Source: CVE Program / CVE List V5
Vulnerability Description
Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP service. In daemon deployments up to and including version 1.1.0, `POST /pins` in `src/filecoin-pinning-server.ts` checks a caller-supplied CID with `CID.parse` and passes it to `pinStore.pin`, but does not enforce request rate limits or per-user quotas. In `src/filecoin-pin-store.ts`, each pin independently schedules `_processPinInBackground` with `setTimeout` without a queue, semaphore or concurrency cap, then recursively traverses the full DAG using `helia.pins.add(cid)`. The per-pin Helia/Bitswap node in `src/create-pinning-helia.ts` has no application-level byte, block or traversal-time limits. Blocks are written under `carStoragePath` by `src/core/car/car-blockstore-base.ts` and `src/core/car/car-file-backend.ts`, with `stats.totalSize` updated only after writing. An authenticated caller, or an anonymous caller when `ALLOW_NO_AUTH=true`, can submit large DAGs and exhaust disk, network, CPU, memory and libp2p resources, causing service degradation or host/process failure and leaving partial CAR files requiring recovery. The default localhost binding and token requirement reduce exposure. Because nodes have no bootstrap or mDNS configuration, a CID alone may not be fetchable, but caller-supplied `origins` can point to a reachable attacker-controlled libp2p source; concurrent requests accelerate resource pressure. Version 1.1.1 documents operational mitigations but does not implement the missing resource controls.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
filecoin-project filecoin-pin <= 1.1.0 -

II. Public POCs for CVE-2026-62300

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-62300

请登录查看更多情报信息。

Other References for CVE-2026-62300 (2)

IV. Related Vulnerabilities

Same product: filecoin-pin
Same vendor: filecoin-project
Same weakness: CWE-400