CVE-2026-52879

Received Received - Intake

Goroutine Flood in Klever-Go Blockchain Protocol

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: GitHub, Inc.

Description

Klever-Go is the Go implementation of the Klever blockchain protocol. In versions 1.7.14 through 1.7.17, the direct-message ingress handler spawns a new goroutine for every incoming direct message before the processor-level antiflood layer makes any admission decision, with no semaphore, throttler, or bound on the number of concurrent in-flight spawns. Because the antiflood check runs inside the spawned goroutine rather than before it, a single connected peer can open a direct-send stream and send a stream of well-formed messages to force unbounded goroutine creation, where each goroutine allocates its own stack and holds a message reference until processing completes, adding scheduler and garbage-collection pressure faster than the runtime can drain it. This lets one peer degrade the node's availability and its ability to process legitimate traffic, resulting in a remotely triggerable denial of service. The issue is fixed in 1.7.18.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-07

Last Modified

2026-08-07

Generated

2026-08-08

AI Q&A

2026-08-08

EPSS Evaluated

N/A

NVD

CVE-2026-52879

Affected Vendors & Products

Vendor	Product	Version / Range
klever	klever-go	From 1.7.14 (inc) to 1.7.17 (inc)
klever	klever-go	1.7.18

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability affects Klever-Go, a Go implementation of the Klever blockchain protocol. In versions 1.7.14 to 1.7.17, the direct-message handler creates a new goroutine for every incoming message without any rate limiting or semaphore control. The antiflood check happens inside these goroutines instead of before spawning them, allowing a single peer to send many messages and force unbounded goroutine creation. Each goroutine consumes memory and CPU, degrading node performance and causing a denial of service.

Detection Guidance

This vulnerability is specific to the Klever-Go implementation and involves unbounded goroutine creation due to improper antiflood checks. Detection requires monitoring for excessive goroutine counts or resource exhaustion in the Klever-Go process. Check for high CPU or memory usage in the Klever-Go node, especially if a single peer is connected. Use system monitoring tools like 'top', 'htop', or 'ps' to observe process behavior. For Go-specific monitoring, use 'go tool pprof' to inspect goroutine counts and stack traces if the process is still responsive.

Impact Analysis

If you run a Klever-Go node using versions 1.7.14 to 1.7.17, an attacker could exploit this flaw by sending many direct messages. This would consume excessive system resources, slow down or crash your node, and prevent it from processing legitimate transactions or messages. The node's availability and performance would degrade, impacting your ability to participate in the network.

Compliance Impact

This vulnerability primarily causes a denial of service by exhausting system resources, which could indirectly impact compliance with standards like GDPR or HIPAA by degrading the availability of systems handling personal or sensitive data. However, the CVE does not explicitly link this issue to compliance failures or data breaches.

Mitigation Strategies

Upgrade Klever-Go to version 1.7.18 or later to address the unbounded goroutine creation issue.

Hi! I’m here to help you understand CVE-2026-52879. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70