CVE-2026-49343
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
Klever-Go, the Go implementation of the Klever blockchain protocol, versions prior to 1.7.18 have a resource-exhaustion flaw in account-data trie syncers. Errors on error paths permanently consume throttler slots, potentially causing sync to stop and bootstrap to fail. Fixed in version 1.7.18.
Risk Assessment
An attacker could cause resource exhaustion, leading to unavailability of nodes and validators, impacting network availability.
Recommendation
Upgrade Klever-Go to version 1.7.18, which includes the fix.
Original NVD description (English source)
Klever-Go is the Go implementation of the Klever blockchain protocol. In versions prior to 1.7.18, the account-data trie syncers are vulnerable to a resource-exhaustion flaw that leaks bounded throttler slots on error paths. In syncDataTrie() (in both userAccountsSyncer.go and kappAccountsSyncer.go), StartProcessing() reserves a slot from the NumGoRoutinesThrottler, but the corresponding EndProcessing() is only called on the success path and on the duplicate-root early return. As a result, any error from trie.NewTrie(), trie.NewTrieSyncer(), or trieSyncer.StartSyncing() (including the network-dependent timeout path) permanently consumes one slot for the lifetime of the throttler. An attacker who can repeatedly cause trie-node sync failures or timeouts during bootstrap can exhaust the bounded throttler, after which further account-data trie syncs stop making progress and SyncAccounts() returns a timeout. Because epoch bootstrap in syncUserAccountsState() and syncKappAccountsState() aborts on any such error, this causes bootstrap to fail, a core availability issue affecting fresh, restarting, or resyncing nodes and validators. This issue is fixed in version 1.7.18.