{"id":"CVE-2023-26248","url":"https://www.cyber-defence.io/tools/cve/CVE-2023-26248","generatedAt":"2026-10-23T18:08:36.785Z","title":"This allows an attacker to censor content by generating many Sybil peers whose peer IDs have a small distance from the content ID, thus hijacking the content resolution process.","description":"The Kademlia DHT (go-libp2p-kad-dht 0.20.0 and earlier) used in IPFS (0.18.1 and earlier) assigns routing information for content (i.e., information about who holds the content) to be stored by peers whose peer IDs have a small DHT distance from the content ID. This allows an attacker to censor content by generating many Sybil peers whose peer IDs have a small distance from the content ID, thus hijacking the content resolution process.","published":"2024-10-25T16:15:10.000Z","lastModified":"2026-06-17T05:42:54.000Z","status":"Deferred","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.1","score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},"cwe":["CWE-352"],"affected":[],"epss":{"score":0.00208,"percentile":0.10396,"date":"2026-10-22","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.21%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://arxiv.org/abs/2307.12212","source":"cve@mitre.org"},{"url":"https://github.com/libp2p/go-libp2p-kad-dht","source":"cve@mitre.org"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2023-26248","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}