Resource Exhaustion Vulnerability in Filecoin Pin API by Filecoin

CVE-2026-62300

What is CVE-2026-62300?

The Filecoin Pin API contains a resource exhaustion vulnerability that allows both authenticated and anonymous users to submit excessively large Directed Acyclic Graphs (DAGs) without appropriate rate limiting or user quotas. This issue arises during the handling of CID submissions via the POST /pins endpoint, which fails to manage resource utilization effectively. As a result, attackers can lead to significant degradation of service or even cause host or process failures by overwhelming disk, network, CPU, and memory resources. Although version 1.1.1 introduces operational mitigations, it does not resolve the core issue of missing resource controls, thus leaving earlier versions vulnerable to abuse. For further details on mitigations, refer to the recent security advisory.

References