{"action":"Upgrade github.com/libp2p/go-libp2p to 0.27.8 or later.","affected":[{"fixed":"0.27.8","introduced":"0"},{"fixed":"0.28.2","introduced":"0.28.0"},{"fixed":"0.29.1","introduced":"0.29.0"}],"component":"github.com/libp2p/go-libp2p","cve_ids":["CVE-2023-39533"],"ecosystem":"Go","epss":0.01501,"exploited":false,"fixed_versions":["0.27.8","0.28.2","0.29.1"],"ghsa_id":"GHSA-876p-8259-xjgg","id":"tcs_01M5KF39DFZ0KQJ7PFVZ2F22VW","modified_at":"2026-09-01T21:45:14.078848597Z","published_at":"2023-08-09T13:18:18Z","references":["https://osv.dev/vulnerability/GHSA-876p-8259-xjgg","https://github.com/libp2p/go-libp2p/security/advisories/GHSA-876p-8259-xjgg","https://nvd.nist.gov/vuln/detail/CVE-2023-39533","https://github.com/golang/go/issues/61460","https://github.com/libp2p/go-libp2p/pull/2454","https://github.com/quic-go/quic-go/pull/4012","https://github.com/golang/go/commit/2350afd2e8ab054390e284c95d5b089c142db017","https://github.com/libp2p/go-libp2p/commit/0cce607219f3710addc7e18672cffd1f1d912fbb","https://github.com/libp2p/go-libp2p/commit/445be526aea4ee0b1fa5388aa65d32b2816d3a00","https://github.com/libp2p/go-libp2p/commit/e30fcf7dfd4715ed89a5e68d7a4f774d3b9aa92d","https://github.com/libp2p/go-libp2p","https://go.dev/issue/61460","https://nrdax.com/techniques/NRDAX-T0205-pre-handshake-crypto-cpu-burn"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-876p-8259-xjgg","url":"https://osv.dev/vulnerability/GHSA-876p-8259-xjgg"}],"summary":"libp2p nodes vulnerable to attack using large RSA keys"}