Read the docs
TI-2026-34832 Aliases CVE-2026-47249GHSA-w342-mj6g-v9c4

Klever-Go KVM: Hash-array amplification in P2P resolver request handling

Priority HIGH 72CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.18, the P2P resolver request handling logic is vulnerable to hash-array amplification. A connected peer can send a compressed RequestDataType_HashArrayType direct request that is only 442 bytes on the wire but expands into 200,000 decoded hash entries inside the resolver path. The resolver's antiflood logic counts only a single logical message and the compressed wire size, and while Batch.Decompress() caps the decompressed byte size, it never limits the number of decoded repeated-field items. As a result, both TxResolver and TrieNodeResolver preallocate and iterate over the entire unchecked set of decoded hashes, causing remote memory and CPU amplification against any node that accepts P2P peer connections. This issue is fixed in version 1.7.18.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00488 42nd percentileScored 2026-11-07
Fix Fixed klever-go (klever-io): 1.7.18github.com/klever-io/klever-go (Go): 1.7.18

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
klever-ioklever-gobefore 1.7.181.7.18Patch availableCNA
—github.com/klever-io/klever-go (Go)before 1.7.181.7.18Patch availableGHSA-w342-mj6g-v9c4
  • klever-go Vendorklever-io Affected before 1.7.18 Fixed in 1.7.18 Patch available CNA
  • github.com/klever-io/klever-go (Go) Vendor— Affected before 1.7.18 Fixed in 1.7.18 Patch available GHSA-w342-mj6g-v9c4

Remediation

  • Fix · CNA klever-go (klever-io) Fixed in 1.7.18
  • Fix · GHSA-w342-mj6g-v9c4 github.com/klever-io/klever-go (Go) Fixed in 1.7.18 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-47249
  2. 2026-10-03 Alias added: GHSA-w342-mj6g-v9c4

References

Other 3

  • TI-2026-40253 Klever-Go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply CVSS 4.0HIGH 8.7
  • TI-2026-40252 Klever-Go: Percentage-transfer royalty skips the source debit at exactly-100% splits CVSS 4.0HIGH 8.7
  • TI-2026-58874 Klever-Go: /log controls global node logging CVSS 3.1HIGH 8.6
  • TI-2026-32588 Klever-Go MultiDataInterceptor: remote OOM via crafted compressed P2P payload CVSS 3.1HIGH 8.6
  • TI-2026-39560 Integer underflow in klever-io klever-go CVSS 3.1CRITICAL 9.6
  • TI-2026-58875 Resource allocation without limits in klever-io klever-go CVSS 3.1HIGH 7.5
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences