CVE-2023-29409
Large RSA keys can cause high CPU usage in crypto/tls
At a glance
- Severity
- Not available
- EPSS
- EPSS 1.60 % · percentile 76 (2026-10-27)
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Go
- NVD status
- Modified
Description
Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <= 8192 bits. Based on a survey of publicly trusted RSA keys, there are currently only three certificates in circulation with keys larger than this, and all three appear to be test certificates that are not actively deployed. It is possible there are larger keys in use in private PKIs, but we target the web PKI, so causing breakage here in the interests of increasing the default safety of users of crypto/tls seems reasonable.
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L | NVD · nvd@nist.gov (Primary) |
Weaknesses (CWE)
Advisories
- GO-2023-1987 — Large RSA keys can cause high CPU usage in crypto/tls
European references
- ENISA EUVD · EUVD-2023-32978
- GCVE · GCVE-0-2023-29409
CERT-FR advisories
- CERTFR-2026-AVI-0339 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0199 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0969 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0622 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0524 — Multiples vulnérabilités dans VMware Tanzu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0256 — Multiples vulnérabilités dans Broadcom VMware Tanzu Greenplum · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0741 — Multiples vulnérabilités dans Juniper Secure Analytics · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0646 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0145 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0119 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0061 — Multiples vulnérabilités dans les produits Splunk · cert.ssi.gouv.fr
- CERTFR-2023-AVI-0757 — Multiples vulnérabilités dans IBM Spectrum Copy Data Management · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*< 1.19.12cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*≥ 1.20.0 < 1.20.7cpe:2.3:a:golang:go:1.21.0:rc1:*:*:*:*:*:*cpe:2.3:a:golang:go:1.21.0:rc2:*:*:*:*:*:*cpe:2.3:a:golang:go:1.21.0:rc3:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Go standard library · crypto/tls | affected 0 < 1.19.12 ; affected 1.20.0-0 < 1.20.7 ; affected 1.21.0-0 < 1.21.0-rc.4 |
References
- https://go.dev/issue/61460
- https://go.dev/cl/515257
- https://groups.google.com/g/golang-announce/c/X0b6CsSAaYI/m/Efv5DbZ9AwAJ
- https://pkg.go.dev/vuln/GO-2023-1987
- https://security.netapp.com/advisory/ntap-20230831-0010/
- https://security.gentoo.org/glsa/202311-09
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |