CVE-2026-47249

Received Received - Intake

Hash-Array Amplification in Klever-Go P2P Resolver

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: GitHub, Inc.

Description

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.18, the P2P resolver request handling logic is vulnerable to hash-array amplification. A connected peer can send a compressed RequestDataType_HashArrayType direct request that is only 442 bytes on the wire but expands into 200,000 decoded hash entries inside the resolver path. The resolver's antiflood logic counts only a single logical message and the compressed wire size, and while Batch.Decompress() caps the decompressed byte size, it never limits the number of decoded repeated-field items. As a result, both TxResolver and TrieNodeResolver preallocate and iterate over the entire unchecked set of decoded hashes, causing remote memory and CPU amplification against any node that accepts P2P peer connections. This issue is fixed in version 1.7.18.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-07

Last Modified

2026-08-07

Generated

2026-08-08

AI Q&A

2026-08-08

EPSS Evaluated

N/A

NVD

CVE-2026-47249

Affected Vendors & Products

Vendor	Product	Version / Range
klever	klever-go	to 1.7.18 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

Klever-Go is a Go implementation of the Klever blockchain protocol. Prior to version 1.7.18, a vulnerability exists in the P2P resolver request handling logic that allows a connected peer to send a compressed request which expands significantly in memory. The request is only 442 bytes on the wire but decompresses into 200,000 hash entries inside the resolver path. The resolver's antiflood logic only counts the compressed size and a single message, not the expanded data, leading to memory and CPU amplification attacks.

Detection Guidance

Detect this vulnerability by checking the version of Klever-Go running on your system. If it is below 1.7.18, the system is vulnerable. Use commands like 'klever-go version' or check package managers for installed versions.

Impact Analysis

This vulnerability can impact you by causing remote memory and CPU amplification attacks against any node running a vulnerable version of Klever-Go that accepts P2P peer connections. Attackers can exploit this to consume excessive system resources, leading to degraded performance or denial of service on affected nodes.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it pertains to a blockchain protocol's P2P network handling. However, if exploited, it could lead to denial-of-service conditions due to resource exhaustion, potentially disrupting services that handle sensitive data, indirectly impacting compliance.

Mitigation Strategies

Upgrade Klever-Go to version 1.7.18 or later immediately. Disable P2P peer connections if possible until the upgrade is completed. Monitor network traffic for unusual hash-array amplification patterns.

Hi! I’m here to help you understand CVE-2026-47249. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70