Skip to content

Conversation

Harshdev098
Copy link

Enforces a maximum digest size of 128 bytes for identity multihashes.

In ipfs/helia, currently allows creation of identity CIDs with arbitrarily large digests.
This can lead to oversized inline CIDs being generated, which poses risks for gateways and blockstores (DoS, unbounded memory growth, etc)

ref: ipfs/helia#846

@rvagg
Copy link
Member

rvagg commented Sep 4, 2025

I don't think this is the right place to do this, they are not strictly limited by the ecosystem, you can make them if you want, it's just that some layers of the stack will reject it, so it's up to the creator to decide on this and I'm not convinced that we should just rule it out wholesale because not everyone using this library is passing data through helia or boxo.

See ipfs/boxo#1018 for background.

@Harshdev098
Copy link
Author

Ahh, got it!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants