CVE-2026-62300 filecoin-project CVE debrief

Who should care

Defenders responsible for IPFS Pinning Service API implementations, particularly those using filecoin-pin, should assess exposure and apply the patch or mitigate the vulnerability to prevent resource exhaustion.

Why it matters

The vulnerability in filecoin-pin can cause resource exhaustion, leading to server unavailability, and defenders should prioritize verifying the version in use, assessing exposure, and applying the patch or mitigating the vulnerability.

• Resource exhaustion can cause the server to become unavailable
• Disk, network, CPU, and libp2p resources can be consumed
• The process or host can become unavailable due to excessive resource usage

Technical summary

The IPFS Pinning Service API implementation in filecoin-pin accepts a caller-controlled CID through POST /pins, queues background processing, and then recursively fetches the full DAG with helia.pins.add(cid). The route and background pinning path do not enforce a request rate limit, per-user quota, maximum DAG byte count, maximum block count, traversal timeout, or concurrent pinning limit. An authenticated caller, or an unauthenticated caller when the server is started with ALLOW_NO_AUTH=true, can submit one or more pins whose CIDs resolve to very large DAGs. This can cause the server to consume disk, network, CPU, and libp2p resources until the process or host becomes unavailable, leading to resource unavail.

Defensive priority

Defenders should prioritize verifying the version of filecoin-pin in use, assessing exposure, and applying the patch or mitigating the vulnerability to prevent resource exhaustion.

Recommended defensive actions

• Verify the version of filecoin-pin in use and assess exposure
• Apply the patch or mitigate the vulnerability to prevent resource exhaustion
• Monitor server resources for signs of exhaustion
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the lack of rate limiting, quota enforcement, and resource limits in the IPFS Pinning Service API implementation. The server writes fetched blocks to CAR files under carStoragePath and can consume resources until the process or host becomes unavailable.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.