CVE-2023-39533 — go-libp2p is the Go implementation of the libp2p Networking Stack

go-libp2p is the Go implementation of the libp2p Networking Stack. Prior to versions 0.27.8, 0.28.2, and 0.29.1 malicious peer can use large RSA keys to run a resource exhaustion attack & force a node to spend time doing signature verification of the large key. This vulnerabi

01What is this vulnerability?

go-libp2p is the Go implementation of the libp2p Networking Stack. Prior to versions 0.27.8, 0.28.2, and 0.29.1 malicious peer can use large RSA keys to run a resource exhaustion attack & force a node to spend time doing signature verification of the large key. This vulnerability is present in the core/crypto module of go-libp2p and can occur during the Noise handshake and the libp2p x509…

02Affected products

Vendor	Product	Versions
libp2p	go	libp2p — < 0.27.8, >= 0.28.0, < 0.28.2, = 0.29.0

03Active exploitation status

Not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS is the best forward-looking signal — see the EPSS row above.

04Recommended remediation

• Patch to a fixed version listed in the vendor advisory (see references below).
• Mitigate with WAF rules, network egress filters, or feature flags where the patch is not yet available.
• Hunt historical logs for exploitation indicators — see Detection signatures below.

05Technical details

For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.

06Detection signatures

Open the Sigma generator with a pre-filled prompt for this CVE to draft a starting detection in your stack of choice:

Open in Sigma generator →

07Related CVEs

No directly-cited follow-up CVEs in the KB record for this advisory. The references list in section 09 carries the vendor cross-references.

08Timeline

• Published: 2023-08-08T18:50:05.418Z
• Last modified: 2024-10-10T17:41:36.824Z

09References

• github.com — https://github.com/libp2p/go-libp2p/security/advisories/GHSA-876p-8259-xjgg
• github.com — https://github.com/golang/go/issues/61460
• github.com — https://github.com/libp2p/go-libp2p/pull/2454
• github.com — https://github.com/quic-go/quic-go/pull/4012
• github.com — https://github.com/golang/go/commit/2350afd2e8ab054390e284c95d5b089c142db017
• github.com — https://github.com/libp2p/go-libp2p/commit/0cce607219f3710addc7e18672cffd1f1d912…
• github.com — https://github.com/libp2p/go-libp2p/commit/445be526aea4ee0b1fa5388aa65d32b2816d3…
• github.com — https://github.com/libp2p/go-libp2p/commit/e30fcf7dfd4715ed89a5e68d7a4f774d3b9aa…