CVE-2023-39533: Github.com/libp2p/go libp2p Libp2p Nodes Vulnerable To Attack Vulnerability

Q: What is CVE-2023-39533?

CVE-2023-39533 is a security vulnerability in Github.com/libp2p/go libp2p involving libp2p nodes vulnerable to attack using large RSA keys under CWE-770: Allocation of Resources Without Limits or Throttling.

Q: Which Github.com/libp2p/go libp2p versions are affected?

Affected versions include releases prior to 0.27.8, 0.28.2, 0.29.1 across affected packages: github.com/libp2p/go-libp2p.

Q: What version fixes CVE-2023-39533?

Upgrading to 0.27.8, 0.28.2, 0.29.1 (or the latest patched release for your respective branch) resolves the vulnerability.

Q: Is github.com/libp2p/go-libp2p affected?

Yes, github.com/libp2p/go-libp2p is affected in releases prior to 0.27.8, 0.28.2, 0.29.1. Upgrade your dependency to 0.27.8, 0.28.2, 0.29.1 or later.

Q: What is the CVSS score of CVE-2023-39533?

CVE-2023-39533 has a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Q: What CWE is associated with CVE-2023-39533?

CVE-2023-39533 is classified under CWE-770: Allocation of Resources Without Limits or Throttling (The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.).

Q: How can I check Go dependencies for CVE-2023-39533?

Run the dependency tree command: 'inspect dependencies for github.com/libp2p/go-libp2p'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

HIGH

Advisory Identifier: GHSA-876p-8259-xjgg

CVSS 7.5

CWE-770

Published 2023-08-09

Advisory Summary

CVE-2023-39533 is a HIGH (CVSS 7.5) libp2p nodes vulnerable to attack vulnerability (CWE-770: Allocation of Resources Without Limits or Throttling) affecting Github.com/libp2p/go libp2p libraries in the Go ecosystem. The issue involves libp2p nodes vulnerable to attack using large rsa keys. Remediation is available by upgrading affected packages to version 0.27.8, 0.28.2, 0.29.1.

CVE-2023-39533 at a Glance

CVE Identifier CVE-2023-39533

GHSA Identifier GHSA-876p-8259-xjgg

Severity HIGH

CVSS v3.1 Base Score 7.5

CWE Classification CWE-770: Allocation of Resources Without Limits or Throttling

Affected Product Github.com/libp2p/go libp2p

Package Ecosystem Go

Published Date 2023-08-09

Last Updated 2026-09-01

Security Impact

CVSS: 7.5

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Attack Vector Network (AV:N)

Attack Complexity Low (AC:L)

Privileges Required None (PR:N)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality None (C:N)

Integrity None (I:N)

Availability High (A:H)

How to Fix CVE-2023-39533

To remediate this vulnerability, upgrade all affected Github.com/libp2p/go libp2p dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

github.com/libp2p/go-libp2p fixed: 0.27.8

Upgrade github.com/libp2p/go-libp2p to 0.27.8

github.com/libp2p/go-libp2p fixed: 0.28.2

Upgrade github.com/libp2p/go-libp2p to 0.28.2

github.com/libp2p/go-libp2p fixed: 0.29.1

Upgrade github.com/libp2p/go-libp2p to 0.29.1

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

inspect dependencies for github.com/libp2p/go-libp2p

How to Check if You Are Affected

To determine whether your application is affected by CVE-2023-39533, inspect your project dependencies for Github.com/libp2p/go libp2p:

inspect dependencies for github.com/libp2p/go-libp2p

Analyze the terminal output to locate any version of Github.com/libp2p/go libp2p in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.27.8), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-770: Allocation of Resources Without Limits or Throttling, where the product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. In Github.com/libp2p/go libp2p, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact A malicious peer can use large RSA keys to run a resource exhaustion attack & force a node to spend time doing signature verification of the large key. This vulnerability is present in the core/crypto module of go-libp2p and can occur during the Noise handshake and the libp2p x509 extension verification step. To prevent this attack, go-libp2p now restricts RSA keys to <= 8192 bits. ### Patches Users should upgrade their go-libp2p versions to >=v0.27.8, >= v0.28.2, or >=v0.29.1 To protect your application, it's necessary to update to these patch releases **AND** to use the updated Go compiler (1.20.7 or 1.19.12, respectively) ### Workarounds There are no known workarounds ### References The Golang crypto/tls package also had this vulnerability ("verifying certificate chains containing large RSA keys is slow” https://github.com/golang/go/issues/61460) Fix in golang/go crypto/tls: https://github.com/golang/go/commit/2350afd2e8ab054390e284c95d5b089c142db017 Fix in quic-go https://github.com/quic-go/quic-go/pull/4012

CVE-2023-39533 Affected Github.com/libp2p/go libp2p Versions

3 component(s)

Fixed Versions:

0.27.80.28.20.29.1

Product / Package	Ecosystem	Affected Versions	Fixed Version
github.com/libp2p/go-libp2p golang/github.com/libp2p/go-libp2p	Go	< 0.27.8	0.27.8
github.com/libp2p/go-libp2p golang/github.com/libp2p/go-libp2p	Go	≥ 0.28.0 < 0.28.2	0.28.2
github.com/libp2p/go-libp2p golang/github.com/libp2p/go-libp2p	Go	≥ 0.29.0 < 0.29.1 All 1 versions 0.29.0	0.29.1

References

GitHub Advisory / Wiki ADVISORY

https://github.com/libp2p/go-libp2p/security/advisories/GHSA-876p-8259-xjgg

NVD — CVE-2023-39533 NVD

https://nvd.nist.gov/vuln/detail/CVE-2023-39533

Github.com/libp2p/go libp2p Source Repository REPOSITORY

https://github.com/golang/go/issues/61460

Github.com/libp2p/go libp2p Source Repository REPOSITORY

https://github.com/libp2p/go-libp2p/pull/2454

Github.com/libp2p/go libp2p Source Repository REPOSITORY

https://github.com/quic-go/quic-go/pull/4012

Security Fix Commit FIX COMMIT

https://github.com/golang/go/commit/2350afd2e8ab054390e284c95d5b089c142db017

Security Fix Commit FIX COMMIT

https://github.com/libp2p/go-libp2p/commit/0cce607219f3710addc7e18672cffd1f1d912fbb

Security Fix Commit FIX COMMIT

https://github.com/libp2p/go-libp2p/commit/445be526aea4ee0b1fa5388aa65d32b2816d3a00

Security Fix Commit FIX COMMIT

https://github.com/libp2p/go-libp2p/commit/e30fcf7dfd4715ed89a5e68d7a4f774d3b9aa92d

Github.com/libp2p/go libp2p Source Repository REPOSITORY

https://github.com/libp2p/go-libp2p

go.dev/issue/61460 WEB

https://go.dev/issue/61460

nrdax.com/techniques/nrdax-t0... WEB

https://nrdax.com/techniques/NRDAX-T0205-pre-handshake-crypto-cpu-burn

Frequently Asked Questions

What is CVE-2023-39533?

CVE-2023-39533 is a security vulnerability in Github.com/libp2p/go libp2p involving libp2p nodes vulnerable to attack using large RSA keys under CWE-770: Allocation of Resources Without Limits or Throttling.

Which Github.com/libp2p/go libp2p versions are affected?

Affected versions include releases prior to 0.27.8, 0.28.2, 0.29.1 across affected packages: github.com/libp2p/go-libp2p.

What version fixes CVE-2023-39533?

Upgrading to 0.27.8, 0.28.2, 0.29.1 (or the latest patched release for your respective branch) resolves the vulnerability.

Is github.com/libp2p/go-libp2p affected?

Yes, github.com/libp2p/go-libp2p is affected in releases prior to 0.27.8, 0.28.2, 0.29.1. Upgrade your dependency to 0.27.8, 0.28.2, 0.29.1 or later.

What is the CVSS score of CVE-2023-39533?

CVE-2023-39533 has a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

What CWE is associated with CVE-2023-39533?

CVE-2023-39533 is classified under CWE-770: Allocation of Resources Without Limits or Throttling (The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.).

How can I check Go dependencies for CVE-2023-39533?

Run the dependency tree command: 'inspect dependencies for github.com/libp2p/go-libp2p'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-876p-8259-xjgg",
  "modified" : "2026-09-01T21:35:26Z",
  "published" : "2023-08-09T13:18:18Z",
  "aliases" : [ "CVE-2023-39533" ],
  "summary" : "libp2p nodes vulnerable to attack using large RSA keys",
  "details" : "### Impact\nA malicious peer can use large RSA keys to run a resource exhaustion attack & force a node to spend time doing signature verification of the large key. This vulnerability is present in the core/crypto module of go-libp2p and can occur during the Noise handshake and the libp2p x509 extension verification step.\nTo prevent this attack, go-libp2p now restricts RSA keys to <= 8192 bits.\n\n### Patches\nUsers should upgrade their go-libp2p versions to >=v0.27.8, >= v0.28.2, or >=v0.29.1\nTo protect your application, it's necessary to update to these patch releases **AND** to use the updated Go compiler (1.20.7 or 1.19.12, respectively)\n\n### Workarounds\nThere are no known workarounds\n\n### References\nThe Golang crypto/tls package also had this vulnerability (\"verifying certificate chains containing large RSA keys is slow” https://github.com/golang/go/issues/61460)\nFix in golang/go crypto/tls: https://github.com/golang/go/commit/2350afd2e8ab054390e284c95d5b089c142db017\nFix in quic-go https://github.com/quic-go/quic-go/pull/4012",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/libp2p/go-libp2p"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.27.8"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/libp2p/go-libp2p"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0.28.0"
      }, {
        "fixed" : "0.28.2"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/libp2p/go-libp2p"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0.29.0"
      }, {
        "fixed" : "0.29.1"
      } ]
    } ],
    "versions" : [ "0.29.0" ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/libp2p/go-libp2p/security/advisories/GHSA-876p-8259-xjgg"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2023-39533"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/golang/go/issues/61460"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/libp2p/go-libp2p/pull/2454"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/quic-go/quic-go/pull/4012"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/golang/go/commit/2350afd2e8ab054390e284c95d5b089c142db017"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/libp2p/go-libp2p/commit/0cce607219f3710addc7e18672cffd1f1d912fbb"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/libp2p/go-libp2p/commit/445be526aea4ee0b1fa5388aa65d32b2816d3a00"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/libp2p/go-libp2p/commit/e30fcf7dfd4715ed89a5e68d7a4f774d3b9aa92d"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/libp2p/go-libp2p"
  }, {
    "type" : "WEB",
    "url" : "https://go.dev/issue/61460"
  }, {
    "type" : "WEB",
    "url" : "https://nrdax.com/techniques/NRDAX-T0205-pre-handshake-crypto-cpu-burn"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-770" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2023-08-09T13:18:18Z",
    "nvd_published_at" : "2023-08-08T19:15:10Z"
  }
}

CVSS V3

7.5 HIGH

Attack Vector Network (AV:N)

Attack Complexity Low (AC:L)

Privileges Required None (PR:N)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality None (C:N)

Integrity None (I:N)

Availability High (A:H)

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Advisory Metadata

Source ID: GHSA-876p-8259-xjgg
Schema Version: 1.4.0
Published: 2023-08-09 13:18
Last Modified: 2026-09-01 21:35
Database Record File: advisories/github-reviewed/2023/08/GHSA-876p-8259-xjgg/GHSA-876p-8259-xjgg.json