{"cve":"CVE-2023-26248","nvd":{"published":"2024-10-25T16:15:09.500","modified":"2026-06-17T05:42:53.813","status":"Deferred","description":"The Kademlia DHT (go-libp2p-kad-dht 0.20.0 and earlier) used in IPFS (0.18.1 and earlier) assigns routing information for content (i.e., information about who holds the content) to be stored by peers whose peer IDs have a small DHT distance from the content ID. This allows an attacker to censor content by generating many Sybil peers whose peer IDs have a small distance from the content ID, thus hijacking the content resolution process.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3},"cwes":["CWE-352"],"references":["https://arxiv.org/abs/2307.12212","https://github.com/libp2p/go-libp2p-kad-dht"],"products":[],"source":"nvd","synced_at":"2026-10-19T21:56:33.105311382+00:00"},"epss":{"cve":"CVE-2023-26248","score":0.00208,"percentile":0.10982,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-mqr9-hjr8-2m9w","url":"https://osv.dev/vulnerability/GHSA-mqr9-hjr8-2m9w","summary":"Content Censorship in the InterPlanetary File System (IPFS) via Kademlia DHT abuse","modified":"2026-09-10T03:50:19.944641544Z","packages":[{"ecosystem":"Go","name":"github.com/libp2p/go-libp2p-kad-dht","purl":"pkg:golang/github.com/libp2p/go-libp2p-kad-dht","ranges":["<=0.20.0"],"fixed":[]}]},{"id":"GO-2024-3218","url":"https://osv.dev/vulnerability/GO-2024-3218","summary":"Content Censorship in the InterPlanetary File System (IPFS) via Kademlia DHT abuse in github.com/libp2p/go-libp2p-kad-dht","modified":"2026-07-01T14:59:24.616695200Z","packages":[{"ecosystem":"Go","name":"github.com/libp2p/go-libp2p-kad-dht","purl":"pkg:golang/github.com/libp2p/go-libp2p-kad-dht","ranges":["all versions"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}