CVE-2023-39533 — go-libp2p is the Go implementation of the libp2p Networking Stack

go-libp2p is the Go implementation of the libp2p Networking Stack. Prior to versions 0.27.8, 0.28.2, and 0.29.1 malicious peer can use large RSA keys to run a resource exhaustion attack & force a node to spend time doing signature verification of the large key. This vulnerabi

01What is this vulnerability?

go-libp2p is the Go implementation of the libp2p Networking Stack. Prior to versions 0.27.8, 0.28.2, and 0.29.1 malicious peer can use large RSA keys to run a resource exhaustion attack & force a node to spend time doing signature verification of the large key. This vulnerability is present in the core/crypto module of go-libp2p and can occur during the Noise handshake and the libp2p x509…

02Affected products

No structured affected-product list available — see references below for vendor advisories.

03Active exploitation status

Not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS is the best forward-looking signal — see the EPSS row above.

04Recommended remediation

• Patch to a fixed version listed in the vendor advisory (see references below).
• Mitigate with WAF rules, network egress filters, or feature flags where the patch is not yet available.
• Hunt historical logs for exploitation indicators — see Detection signatures below.

05Technical details

For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.

06Detection signatures

Ask SARA in chat to draft a starting detection for this CVE in your stack of choice.

07Related CVEs

No directly-cited follow-up CVEs in the KB record for this advisory. The references list in section 09 carries the vendor cross-references.

08Timeline

• Published: 2023-08-08T19:15:10.657
• Last modified: 2026-09-01T22:17:08.920

09References

• github.com — https://github.com/golang/go/commit/2350afd2e8ab054390e284c95d5b089c142db017
• github.com — https://github.com/golang/go/issues/61460
• github.com — https://github.com/libp2p/go-libp2p/commit/0cce607219f3710addc7e18672cffd1f1d912…
• github.com — https://github.com/libp2p/go-libp2p/commit/445be526aea4ee0b1fa5388aa65d32b2816d3…
• github.com — https://github.com/libp2p/go-libp2p/commit/e30fcf7dfd4715ed89a5e68d7a4f774d3b9aa…
• github.com — https://github.com/libp2p/go-libp2p/pull/2454
• github.com — https://github.com/libp2p/go-libp2p/security/advisories/GHSA-876p-8259-xjgg
• github.com — https://github.com/quic-go/quic-go/pull/4012
• nrdax.com — https://nrdax.com/techniques/NRDAX-T0205-pre-handshake-crypto-cpu-burn
• github.com — https://github.com/golang/go/commit/2350afd2e8ab054390e284c95d5b089c142db017