CVE-2026-47249: CWE-400: Uncontrolled Resource Consumption in klever-io klever-go
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.18, the P2P resolver request handling logic is vulnerable to hash-array amplification. A connected peer can send a compressed RequestDataType_HashArrayType direct request that is only 442 bytes on the wire but expands into 200,000 decoded hash entries inside the resolver path. The resolver's antiflood logic counts only a single logical message and the compressed wire size, and while Batch.Decompress() caps the decompressed byte size, it never limits the number of decoded repeated-field items. As a result, both TxResolver and TrieNodeResolver preallocate and iterate over the entire unchecked set of decoded hashes, causing remote memory and CPU amplification against any node that accepts P2P peer connections. This issue is fixed in version 1.7.18.
AI Analysis
Technical Summary
Klever-Go, the Go implementation of the Klever blockchain protocol, has a CWE-400 uncontrolled resource consumption vulnerability in versions before 1.7.18. The flaw exists in the P2P resolver request handling where a compressed RequestDataType_HashArrayType message of 442 bytes decompresses into 200,000 decoded hash entries. The antiflood logic only counts the compressed message size and a single logical message, failing to limit the number of decoded repeated-field items. Consequently, TxResolver and TrieNodeResolver preallocate and process the entire unchecked set of hashes, causing significant memory and CPU usage amplification. This can be exploited remotely by any peer connecting to the node. The vulnerability is addressed in version 1.7.18.
Potential Impact
Exploitation of this vulnerability results in high resource consumption (memory and CPU) on affected nodes, potentially leading to denial of service by exhausting system resources. There is no impact on confidentiality or integrity reported. The vulnerability can be triggered remotely by any peer connecting to the P2P network.
Mitigation Recommendations
A fix is available in Klever-Go version 1.7.18. Users should upgrade to version 1.7.18 or later to remediate this vulnerability. No other mitigation or temporary workaround is indicated.
CVE-2026-47249: CWE-400: Uncontrolled Resource Consumption in klever-io klever-go
Description
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.18, the P2P resolver request handling logic is vulnerable to hash-array amplification. A connected peer can send a compressed RequestDataType_HashArrayType direct request that is only 442 bytes on the wire but expands into 200,000 decoded hash entries inside the resolver path. The resolver's antiflood logic counts only a single logical message and the compressed wire size, and while Batch.Decompress() caps the decompressed byte size, it never limits the number of decoded repeated-field items. As a result, both TxResolver and TrieNodeResolver preallocate and iterate over the entire unchecked set of decoded hashes, causing remote memory and CPU amplification against any node that accepts P2P peer connections. This issue is fixed in version 1.7.18.
CVSS v3.1
Score 7.5high
Affected software
klever-io
klever-go
pkg:golang/github.com/klever-io/klever-goRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Klever-Go, the Go implementation of the Klever blockchain protocol, has a CWE-400 uncontrolled resource consumption vulnerability in versions before 1.7.18. The flaw exists in the P2P resolver request handling where a compressed RequestDataType_HashArrayType message of 442 bytes decompresses into 200,000 decoded hash entries. The antiflood logic only counts the compressed message size and a single logical message, failing to limit the number of decoded repeated-field items. Consequently, TxResolver and TrieNodeResolver preallocate and process the entire unchecked set of hashes, causing significant memory and CPU usage amplification. This can be exploited remotely by any peer connecting to the node. The vulnerability is addressed in version 1.7.18.
Potential Impact
Exploitation of this vulnerability results in high resource consumption (memory and CPU) on affected nodes, potentially leading to denial of service by exhausting system resources. There is no impact on confidentiality or integrity reported. The vulnerability can be triggered remotely by any peer connecting to the P2P network.
Mitigation Recommendations
A fix is available in Klever-Go version 1.7.18. Users should upgrade to version 1.7.18 or later to remediate this vulnerability. No other mitigation or temporary workaround is indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-18T22:54:18.273Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a765bb3bf8831d539436f3c
Added to database: 08/07/2026, 22:26:59 UTC
Last enriched: 08/15/2026, 15:32:20 UTC
Last updated: 09/22/2026, 01:52:43 UTC
Views: 57
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.