CVE-2023-40583 libp2p nodes vulnerable to OOM attack
A malicious actor can exhaust memory in go-libp2p nodes via signed peer records, causing a crash and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-40583?
CVE-2023-40583 is a high-severity denial of service vulnerability in go-libp2p, published on 25 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
libp2p is a networking stack and library modularized out of The IPFS Project, and bundled separately for other tools to use. In go-libp2p, by using signed peer records a malicious actor can store an arbitrary amount of data in a remote node’s memory. This memory does not get garbage collected and so the victim can run out of memory and crash. If users of go-libp2p in production are not monitoring memory consumption over time, it could be a silent attack i.e. the attacker could bring down nodes over a period of time (how long depends on the node resources i.e. a go-libp2p node on a virtual server with 4 gb of memory takes about 90 sec to bring down; on a larger server, it might take a bit longer.) This issue was patched in version 0.27.4.
Weakness: CWE-400
Which versions are affected by CVE-2023-40583?
3 open source packages ship an affected version, including github.com/libp2p/go-libp2p. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/libp2p/go-libp2p Go | All versions | 0.27.4 |
github.com/libp2p/go-libp2p Go | All versions | 0.27.4 |
github.com/libp2p/go-libp2p Go | All versions | 0.27.4 |
Products include Protocol Libp2p.
How do I fix CVE-2023-40583?
Upgrade github.com/libp2p/go-libp2p to 0.27.4 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-40583 being exploited?
There is no known exploitation of CVE-2023-40583 in the wild and no public exploit code.
Other vulnerabilities in go-libp2p
- CVE-2026-35457 libp2p-rust has unbounded rendezvous DISCOVER cookies enable remote memory exhaustion
- CVE-2026-35405 libp2p-rendezvous: Unlimited namespace registrations per peer enables OOM DoS on rendezvous servers
- CVE-2022-23492 go-libp2p denial of service vulnerability from lack of resource management
- CVE-2022-23486 libp2p-rust denial of service vulnerability from lack of resource management
- CVE-2022-23487 libp2p denial of service vulnerability from lack of resource management
Sources
Also known as GHSA-gcq9-qqwx-rgj3, GO-2023-2024.