Executive brief
Klever-Go is a core component used in the Klever blockchain ecosystem. A vulnerability in how it handles peer-to-peer (P2P) requests allows a remote attacker to send a very small, specially crafted message that consumes a massive amount of memory and processing power on the target server. This can lead to a denial-of-service (DoS) condition, potentially knocking blockchain nodes offline and disrupting the network's availability.
Technical details
A resource exhaustion vulnerability (CWE-400) exists in Klever-Go's P2P resolver request handling. The root cause is that the 'Batch.Decompress()' function and subsequent resolver logic (TxResolver and TrieNodeResolver) do not enforce a limit on the number of decoded repeated-field items, even though they enforce a byte-size cap. An attacker can send a compressed 'RequestDataType_HashArrayType' message as small as 442 bytes that expands into 200,000 hash entries upon decompression. This results in significant memory pressure and synchronous CPU work during preallocation and iteration of the decoded hashes. The vulnerability is reachable via libp2p direct-send plumbing and is fixed in version 1.7.18.
Affected products
- klever-io klever-go < 1.7.18
Timeline
- 2026-06-02: disclosed
- 2026-06-02: patched: Version 1.7.18 released
- 2026-06-05: advisory