Vulnerability · Published Aug 7, 2026 · Assigned by GitHub_M
CVE-2026-52879Klever-Go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoS
High 7.5
In plain English
A high-severity uncontrolled resource consumption in klever-go from klever-io. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Klever-Go is the Go implementation of the Klever blockchain protocol. In versions 1.7.14 through 1.7.17, the direct-message ingress handler spawns a new goroutine for every incoming direct message before the processor-level antiflood layer makes any admission decision, with no semaphore, throttler, or bound on the number of concurrent in-flight spawns. Because the antiflood check runs inside the spawned goroutine rather than before it, a single connected peer can open a direct-send stream and send a stream of well-formed messages to force unbounded goroutine creation, where each goroutine allocates its own stack and holds a message reference until processing completes, adding scheduler and garbage-collection pressure faster than the runtime can drain it. This lets one peer degrade the node's availability and its ability to process legitimate traffic, resulting in a remotely triggerable denial of service. The issue is fixed in 1.7.18.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/klever-io/klever-go | 1.7.18 | GHSA-hf2g-6j7h-98wg |
| Go | github.com/klever-io/klever-go | 1.7.18 | GO-2026-5424 |
Affected products (as reported)
Weakness: CWE-400, CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/klever-io/klever-go/security/advisories/GHSA-hf2g-6j7h-98wg x_refsource_CONFIRM
- https://github.com/klever-io/klever-go/releases/tag/v1.7.18 x_refsource_MISC