CVE-2023-39533

go-libp2p is the Go implementation of the libp2p Networking Stack. Prior to versions 0.27.8, 0.28.2, and 0.29.1 malicious peer can use large RSA keys to run a resource exhaustion attack & force a node to spend time doing signature verification of the large key. This vulnerability is present in the core/crypto module of go-libp2p and can occur during the Noise handshake and the libp2p x509 extension verification step. To prevent this attack, go-libp2p versions 0.27.8, 0.28.2, and 0.29.1 restrict RSA keys to <= 8192 bits. To protect one's application, it is necessary to update to these patch releases and to use the updated Go compiler in 1.20.7 or 1.19.12. There are no known workarounds for this issue.

What this means for your business

It affects Libp2p Go-Libp2p. It matters if your company, or a supplier that handles your data, runs it.
Code showing how to exploit it has been published, but real attacks have not been confirmed.
An attacker can use it remotely, over a network, without a login, and without anyone at your company clicking anything.
FIRST's prediction model gives it a 2% chance of attack attempts being seen in the next 30 days, ranking above 72% of all known flaws.

What to do

1Check whether your company or your suppliers run Libp2p Go-Libp2p, and which version. The affected versions are listed further down this page.
2If you do, apply the vendor's fix. A patch or vendor advisory has been published.

Not sure if your company is exposed?

Fastnexa’s certified penetration testers can check whether attackers could use this flaw, or others like it, against your websites, apps and network. The full test is free for our first 10 founding clients until 31 December 2026.

Check if you’re exposed Book a call

Scoring

CVSS: 7.5 (v3.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-770
Assigned by: security-advisories@github.com

Dates

Published: 2023-08-08
Last modified: 2026-09-01
Sources: NVD

Affected products

Libp2p Go-Libp2p- 0.27.8, 0.28.0 - 0.28.2, 0.29.0

As listed in the NVD configuration data. Not a statement about your estate.