CVE-2023-40583

HighCVSS 7.5

Published: 25/08/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.77%

51th percentile - higher than 51% of all known CVEs

Summary

In the go-libp2p library, using signed peer records, a malicious actor can store an arbitrary amount of data in a remote node's memory. This memory is not garbage collected, which can lead to memory exhaustion and node crashes.

Risk Assessment

Failure to monitor memory consumption by go-libp2p users in production can lead to silent attacks that gradually take down nodes. The time required to bring down a node depends on the server resources.

Recommendation

It is recommended to monitor memory usage of nodes using go-libp2p and to upgrade to version 0.27.4 to patch this vulnerability.

Other vulnerabilities in go-libp2p

CVE-2023-39533High
In go-libp2p, prior to versions 0.27.8, 0.28.2, and 0.29.1, a malicious peer can use large RSA keys to perform a resource exhaustion attack, forcing a node to spend time verifying signatures of the large key.

Original NVD description (English source)

libp2p is a networking stack and library modularized out of The IPFS Project, and bundled separately for other tools to use. In go-libp2p, by using signed peer records a malicious actor can store an arbitrary amount of data in a remote node’s memory. This memory does not get garbage collected and so the victim can run out of memory and crash. If users of go-libp2p in production are not monitoring memory consumption over time, it could be a silent attack i.e. the attacker could bring down nodes over a period of time (how long depends on the node resources i.e. a go-libp2p node on a virtual server with 4 gb of memory takes about 90 sec to bring down; on a larger server, it might take a bit longer.) This issue was patched in version 0.27.4.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS