CVE-2023-39533 libp2p nodes vulnerable to attack using large RSA keys

Q: Which versions are affected by CVE-2023-39533?

7 open source packages ship an affected version, including github.com/libp2p/go-libp2p. It affects 1 product.

Q: Is CVE-2023-39533 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-39533 exists.

Q: How do I fix CVE-2023-39533?

Upgrade github.com/libp2p/go-libp2p to a fixed version for your release line: 0.27.8, 0.28.2 or 0.29.1.

High 7.5 Published 8 Aug 2023 Updated 1 Sep 2026

A malicious peer can cause resource exhaustion and denial of service in go-libp2p nodes by using large RSA keys during handshake verification.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-39533?

CVE-2023-39533 is a high-severity denial of service vulnerability in go-libp2p, published on 8 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

go-libp2p is the Go implementation of the libp2p Networking Stack. Prior to versions 0.27.8, 0.28.2, and 0.29.1 malicious peer can use large RSA keys to run a resource exhaustion attack & force a node to spend time doing signature verification of the large key. This vulnerability is present in the core/crypto module of go-libp2p and can occur during the Noise handshake and the libp2p x509 extension verification step. To prevent this attack, go-libp2p versions 0.27.8, 0.28.2, and 0.29.1 restrict RSA keys to <= 8192 bits. To protect one's application, it is necessary to update to these patch releases and to use the updated Go compiler in 1.20.7 or 1.19.12. There are no known workarounds for this issue.

Weakness: CWE-770

Which versions are affected by CVE-2023-39533?

7 open source packages ship an affected version, including github.com/libp2p/go-libp2p. It affects 1 product.

Package	Affected	Fixed in
`github.com/libp2p/go-libp2p` Go	All versions	`0.27.8, 0.28.2, 0.29.1`
`github.com/libp2p/go-libp2p` Go	All versions	`0.27.8`
`github.com/libp2p/go-libp2p` Go	All versions	`0.27.8`
`github.com/libp2p/go-libp2p` Go	From `0.28.0`	`0.28.2`
`github.com/libp2p/go-libp2p` Go	From `0.28.0`	`0.28.2`
`github.com/libp2p/go-libp2p` Go	From `0.29.0`	`0.29.1`

1 more packages

github.com/libp2p/go-libp2p Go From 0.29.0 0.29.1

Products include Libp2p Go-Libp2p.

How do I fix CVE-2023-39533?

Upgrade github.com/libp2p/go-libp2p to a fixed version for your release line: 0.27.8, 0.28.2 or 0.29.1.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-39533 being exploited?