Filecoin Pin is a pinning service API that allows clients to request that a content identifier (CID) be pinned to the Filecoin network. The server performs a recursive traversal of the DAG referenced by the CID, writing CAR files to disk and exchanging data over libp2p. In versions up to 1.1.0, the implementation does not impose any per‑request or per‑user limits on the size, traversal depth, or number of concurrent pins. Each submitted pin immediately schedules a background job that walks the entire DAG without any queue or semaphore. Because the application cannot constrain the amount of disk space, bandwidth, CPU time or memory consumed, an authenticated request – or a request made when the ALLOW_NO_AUTH flag is enabled – can submit a gigantic DAG that exhausts host resources. The result is degraded service, possible process termination or an unresponsive service, and incomplete CAR files that may require recovery. This vulnerability falls under the CWE‑400 category of unbounded resource consumption.

The vulnerability affects the filecoin-project filecoin-pin service, all daemon deployments using version 1.1.0 or earlier. The default configuration binds only to localhost and requires an authentication token, but the lack of resource limits still permits a local attacker or an attacker who has obtained a valid token to trigger the issue. No external products or other vendors are listed. Affected versions are 1.1.0 and earlier; version 1.1.1 adds documentation but not the controls.

The CVSS score is 6.5, indicating a moderate risk level. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting a limited current exploitation footprint. The likely attack vector is a remote or local HTTP POST to /pins; the server processes the request without any throttling, so any user that can reach the API may inadvertently or maliciously exhaust disk, network, CPU or memory resources. The absence of queueing or concurrency controls means multiple simultaneous requests will amplify the impact. An attacker with the appropriate permissions can trigger the denial of service at the node level or cause the entire service to fail, leading to downtime or potential data loss.