Vulnerability · Published Aug 7, 2026 · Assigned by GitHub_M
CVE-2026-47249Klever-Go KVM: Hash-array amplification in P2P resolver request handling
High 7.5
In plain English
A high-severity uncontrolled resource consumption in klever-go from klever-io. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.18, the P2P resolver request handling logic is vulnerable to hash-array amplification. A connected peer can send a compressed RequestDataType_HashArrayType direct request that is only 442 bytes on the wire but expands into 200,000 decoded hash entries inside the resolver path. The resolver's antiflood logic counts only a single logical message and the compressed wire size, and while Batch.Decompress() caps the decompressed byte size, it never limits the number of decoded repeated-field items. As a result, both TxResolver and TrieNodeResolver preallocate and iterate over the entire unchecked set of decoded hashes, causing remote memory and CPU amplification against any node that accepts P2P peer connections. This issue is fixed in version 1.7.18.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/klever-io/klever-go | 1.7.18 | GO-2026-5685 |
| Go | github.com/klever-io/klever-go | 1.7.18 | GHSA-w342-mj6g-v9c4 |
Affected products (as reported)
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/klever-io/klever-go/security/advisories/GHSA-w342-mj6g-v9c4 x_refsource_CONFIRM
- https://github.com/klever-io/klever-go/releases/tag/v1.7.18 x_refsource_MISC