# CVE-2023-39533: libp2p go-libp2p resource exhaustion via large RSA keys

Source: https://junglewise.ai/threats/cve-2023-39533-libp2p-go-libp2p-resource-exhaustion-via-large-rsa-keys  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-08-09. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2023-39533 · Severity: high · CVSS 7.5 · Published 2023-08-09

The go-libp2p library is a core networking component used in peer-to-peer applications, including blockchain systems and distributed protocols. A remote attacker can send specially crafted cryptographic handshakes with oversized RSA keys to exhaust CPU resources on libp2p nodes, causing service degradation and denial of availability without needing any special privileges or authentication.

Technologies: [github.com/libp2p/go-libp2p (Go)](https://junglewise.ai/threats/technologies/github-com-libp2p-go-libp2p). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Libp2p](https://junglewise.ai/threats/vendors/libp2p).

## Quick answers

**Is CVE-2023-39533 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-39533 being exploited in the wild.

**How severe is CVE-2023-39533?** High severity, with a CVSS score of 7.5, published 9 August 2023.

**Which products and versions are affected?** github.com/libp2p/go-libp2p (Go) SEMVER:introduced=0,fixed=0.27.8, SEMVER:introduced=0,fixed=0.27.8,introduced=0.28.0,fixed=0.28.2,introduced=0.29.0,fixed=0.29.1; Libp2p Go-Libp2p < 0.27.8, >= 0.28.0 and < 0.28.2, = 0.29.0.

**Is there a fix for CVE-2023-39533?** Yes. github.com/libp2p/go-libp2p (Go): upgrade to 0.27.8, 0.29.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-39533 attacked?** It is attacked over the network.

**Am I affected by CVE-2023-39533?** Check whether you run github.com/libp2p/go-libp2p (Go) or Libp2p Go-Libp2p at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/libp2p/go-libp2p (Go): upgrade to 0.27.8, 0.29.1 or later

  ```sh
  go get github.com/libp2p/go-libp2p@v0.29.1
  ```


## Technical details

This is a resource exhaustion vulnerability (CWE-770) in the cryptographic signature verification component of go-libp2p. During peer authentication via the Noise protocol handshake and libp2p x509 extension verification, the affected versions accept and attempt to verify RSA keys of arbitrary size without resource limits. An attacker can send large RSA keys (e.g., 16384 bits or larger) that require substantial CPU time for signature verification operations, monopolizing node resources and causing denial of service. Attack requires network reachability to the libp2p node but no authentication or user interaction. Patches are available in go-libp2p v0.27.8, v0.28.2, and v0.29.1, but users must also update to Go compiler versions 1.20.7 or 1.19.12 to gain the corresponding upstream Go crypto/tls fixes. No workarounds are known.

## Affected products

- libp2p go-libp2p < 0.27.8, >= 0.28.0 and < 0.28.2, = 0.29.0

## Identifiers

- CVE-2023-39533
- GHSA-876p-8259-xjgg
- GO-2023-2000

## Timeline

- 2023-08-09: disclosed
- 2023-08-08: advisory: NVD published
- 2023-08-09: patched: Patches available in v0.27.8, v0.28.2, v0.29.1

## References

- [https://api.github.com/users/marten-seemann](https://api.github.com/users/marten-seemann)
- [https://github.com/marten-seemann](https://github.com/marten-seemann)
- [https://api.github.com/users/marten-seemann/gists%7B/gist_id%7D](https://api.github.com/users/marten-seemann/gists%7B/gist_id%7D)
- [https://api.github.com/users/marten-seemann/repos](https://api.github.com/users/marten-seemann/repos)
- [https://avatars.githubusercontent.com/u/1478487?v=4](https://avatars.githubusercontent.com/u/1478487?v=4)
- [https://api.github.com/users/marten-seemann/events%7B/privacy%7D](https://api.github.com/users/marten-seemann/events%7B/privacy%7D)

## Related threats

- [GO-2023-2024 - Out-of-memory vulnerability in github.com/libp2p/go-libp2p](https://junglewise.ai/threats/cve-2023-40583-libp2p-nodes-vulnerable-to-oom-attack)
- [GO-2022-1148 - Resource exhaustion in github.com/libp2p/go-libp2p](https://junglewise.ai/threats/cve-2022-23492-libp2p-dos-vulnerability-from-lack-of-resource-management)