Klever-Go, the Go implementation of the Klever blockchain protocol, has a vulnerability (CVE-2026-47249) in versions before 1.7.18 where the P2P resolver request handling logic is susceptible to hash-array amplification. A compressed RequestDataType_HashArrayType request of only 442 bytes can decompress into 200,000 hash entries. The antiflood logic counts only the compressed message size and a single logical message, but does not limit the number of decoded repeated-field items. Consequently, TxResolver and TrieNodeResolver preallocate and process the entire large set of decoded hashes, resulting in remote memory and CPU resource exhaustion for nodes accepting P2P connections. This vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption).

An attacker can cause a denial of service by sending a specially crafted compressed request that expands into a very large number of hash entries, leading to excessive memory allocation and CPU usage on the targeted node. This can degrade or disrupt the availability of the affected Klever-Go node. There is no impact on confidentiality or integrity according to the CVSS vector. No known exploits in the wild have been reported.

This vulnerability is fixed in Klever-Go version 1.7.18. Users should upgrade to version 1.7.18 or later to remediate this issue. No other mitigation or temporary workaround is indicated. Patch status is not explicitly confirmed in vendor advisories but the fix version is clearly stated.