Klever-Go, the Go implementation of the Klever blockchain protocol, has a resource-exhaustion vulnerability (CWE-400) in versions before 1.7.18. The account-data trie syncers leak bounded throttler slots on error paths because EndProcessing() is not called when errors occur in syncDataTrie(). This causes permanent consumption of throttler slots when errors arise from trie.NewTrie(), trie.NewTrieSyncer(), or trieSyncer.StartSyncing(), including network timeouts. An attacker able to induce repeated trie-node sync failures or timeouts during bootstrap can exhaust the throttler, halting account-data trie sync progress and causing SyncAccounts() to timeout. Bootstrap aborts on these errors, resulting in a core availability issue affecting nodes and validators during bootstrap or resync. The vulnerability is resolved in version 1.7.18.

The vulnerability causes a denial of service condition by exhausting throttler slots needed for account-data trie synchronization. This prevents successful bootstrap of nodes and validators, impacting availability of fresh, restarting, or resyncing nodes. There is no impact on confidentiality or integrity. The CVSS score is 5.9 (medium severity) reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and an availability impact.

Upgrade Klever-Go to version 1.7.18 or later, where this resource exhaustion issue is fixed. Patch status is confirmed by the vendor stating the fix in 1.7.18. No other mitigations are indicated.