CVE-2026-49343

Received Received - Intake

Resource Exhaustion in Klever-Go Blockchain Protocol

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: GitHub, Inc.

Description

Klever-Go is the Go implementation of the Klever blockchain protocol. In versions prior to 1.7.18, the account-data trie syncers are vulnerable to a resource-exhaustion flaw that leaks bounded throttler slots on error paths. In syncDataTrie() (in both userAccountsSyncer.go and kappAccountsSyncer.go), StartProcessing() reserves a slot from the NumGoRoutinesThrottler, but the corresponding EndProcessing() is only called on the success path and on the duplicate-root early return. As a result, any error from trie.NewTrie(), trie.NewTrieSyncer(), or trieSyncer.StartSyncing() (including the network-dependent timeout path) permanently consumes one slot for the lifetime of the throttler. An attacker who can repeatedly cause trie-node sync failures or timeouts during bootstrap can exhaust the bounded throttler, after which further account-data trie syncs stop making progress and SyncAccounts() returns a timeout. Because epoch bootstrap in syncUserAccountsState() and syncKappAccountsState() aborts on any such error, this causes bootstrap to fail, a core availability issue affecting fresh, restarting, or resyncing nodes and validators. This issue is fixed in version 1.7.18.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-07

Last Modified

2026-08-07

Generated

2026-08-08

AI Q&A

2026-08-08

EPSS Evaluated

N/A

NVD

CVE-2026-49343

Affected Vendors & Products

Vendor	Product	Version / Range
klever	klever-go	to 1.7.18 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.
CWE-772	The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.

Attack-Flow Graph

Executive Summary

Klever-Go is a Go implementation of the Klever blockchain protocol. Versions before 1.7.18 have a flaw where account-data trie syncers leak throttler slots during errors. The StartProcessing() function reserves a slot but EndProcessing() is only called on success or duplicate-root paths. Errors in trie operations cause permanent slot consumption, leading to throttler exhaustion. This stops further account-data trie syncs, causing bootstrap failures in nodes and validators.

Detection Guidance

This vulnerability is specific to the Klever-Go blockchain protocol implementation and involves resource exhaustion in account-data trie syncers. Detection would require monitoring for failed trie sync operations or timeouts during bootstrap, particularly in fresh, restarting, or resyncing nodes. Check logs for errors related to trie.NewTrie(), trie.NewTrieSyncer(), or trieSyncer.StartSyncing() in versions prior to 1.7.18.

Impact Analysis

If you run a Klever-Go node or validator using a vulnerable version, this flaw can cause your node to fail during bootstrap or resync. This leads to core availability issues, preventing the node from syncing or validating transactions. An attacker could repeatedly trigger sync failures to exhaust throttler slots, making the node unusable.

Compliance Impact

This vulnerability primarily impacts system availability by causing bootstrap failures in nodes and validators, which could lead to prolonged downtime or service disruptions. While not directly violating GDPR or HIPAA, such disruptions may indirectly affect compliance by impairing data processing or access controls required for these regulations.

Mitigation Strategies

Upgrade Klever-Go to version 1.7.18 or later to address the resource-exhaustion flaw in account-data trie syncers.

Hi! I’m here to help you understand CVE-2026-49343. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70