TI-2023-21381 Aliases CVE-2023-40583 GHSA-gcq9-qqwx-rgj3

libp2p nodes vulnerable to OOM attack

MEDIUM 41CWE-400Published 2023-08-25 · Updated 2024-10-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

libp2p is a networking stack and library modularized out of The IPFS Project, and bundled separately for other tools to use. In go-libp2p, by using signed peer records a malicious actor can store an arbitrary amount of data in a remote node’s memory. This memory does not get garbage collected and so the victim can run out of memory and crash. If users of go-libp2p in production are not monitoring memory consumption over time, it could be a silent attack i.e. the attacker could bring down nodes over a period of time (how long depends on the node resources i.e. a go-libp2p node on a virtual server with 4 gb of memory takes about 90 sec to bring down; on a larger server, it might take a bit longer.) This issue was patched in version 0.27.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00952 61st percentileScored 2026-11-07

Fix Fixed go-libp2p (libp2p): 0.27.4github.com/libp2p/go-libp2p (Go): 0.27.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
libp2p	go-libp2p	before 0.27.4	0.27.4	Patch available	CNA
—	github.com/libp2p/go-libp2p (Go)	before 0.27.4	0.27.4	Patch available	GHSA-gcq9-qqwx-rgj3

go-libp2p Vendorlibp2p Affected before 0.27.4 Fixed in 0.27.4 Patch available CNA
github.com/libp2p/go-libp2p (Go) Vendor— Affected before 0.27.4 Fixed in 0.27.4 Patch available GHSA-gcq9-qqwx-rgj3

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:protocol:libp2p::::::go::*	before 0.27.4	Vulnerable	Protocol

cpe:2.3:a:protocol:libp2p:*:*:*:*:*:go:*:* Versions before 0.27.4 Vulnerable ·Protocol

Remediation

Fix · CNA go-libp2p (libp2p) Fixed in 0.27.4
Fix · GHSA-gcq9-qqwx-rgj3 github.com/libp2p/go-libp2p (Go) Fixed in 0.27.4 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2023-40583
2026-10-03 Alias added: GHSA-gcq9-qqwx-rgj3

References

Patch 1

https://github.com/libp2p/go-libp2p/commit/45d3c6fff662ddd6938982e7e9309ad5fa2ad8dd

Advisory 2

Other 3

TI-2026-60386 libp2p-rendezvous through 0.17.1 Denial of Service via Unbounded Registration TTL in Discovery Responses CVSS 4.0HIGH 8.7
TI-2026-58865 libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses CVSS 3.1HIGH 8.2
TI-2026-44102 libp2p-quic: Remote panic via certificate expiry race during QUIC handshake CVSS 4.0HIGH 8.2
TI-2026-27587 libp2p-rust has unbounded rendezvous DISCOVER cookies enable remote memory exhaustion CVSS 3.1HIGH 8.2
TI-2026-58864 libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID CVSS 3.1HIGH 7.5
TI-2026-53982 libp2p: Circuit relay v2 server reservation refresh leaks abort listeners and allows remote resource exhaustion CVSS 3.1HIGH 7.5

See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences