Detections
Analytics
SCA: security update for github.com/libp2p/go-libp2p (GHSA-j7qp-mfxf-8xjw)
high Tenable Self-Hosted Container Security Plugin ID 416218
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- go-libp2p is the offical libp2p implementation in the Go programming language. Version `0.18.0` and older
of go-libp2p are vulnerable to targeted resource exhaustion attacks. These attacks target libp2p’s
connection, stream, peer, and memory management. An attacker can cause the allocation of large amounts of
memory, ultimately leading to the process getting killed by the host’s operating system. While a
connection manager tasked with keeping the number of connections within manageable limits has been part of
go-libp2p, this component was designed to handle the regular churn of peers, not a targeted resource
exhaustion attack. Users are advised to upgrade their version of go-libp2p to version `0.18.1` or newer.
Users unable to upgrade may consult the denial of service (dos) mitigation page for more information on
how to incorporate mitigation strategies, monitor your application, and respond to attacks.
(CVE-2022-23492)
See Also
Plugin Details
Severity: High
ID: 416218
Version: Revision 1.7
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.18
Vendor
Vendor Severity: High
CVSS v2
Risk Factor: High
Base Score: 7.8
Temporal Score: 5.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C
CVSS Score Source: CVE-2022-23492
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 12/7/2022
Vulnerability Publication Date: 12/7/2022
Reference Information
CVE: CVE-2022-23492
cwe: CWE-400