CVE-2026-49343: Klever-io Klever-Go throttler slot leak in trie account-data sync

Executive brief

Klever-Go is a blockchain infrastructure component. A flaw in how it manages internal processing tasks during data synchronization allows an attacker to trigger repeated failures that permanently consume available task slots. This can lead to a denial-of-service condition where the system is unable to sync state or complete its startup process, effectively knocking the node offline.

Technical details

A resource leak exists in the `syncDataTrie()` function within `userAccountsSyncer.go` and `kappAccountsSyncer.go`. The component calls `StartProcessing()` on a `NumGoRoutinesThrottler` but fails to call `EndProcessing()` on several error return paths, such as when `NewTrie`, `NewTrieSyncer`, or `StartSyncing` fail. Because the throttler uses a strict bounded counter, these leaked slots are never recovered. An attacker who can induce network timeouts or synchronization errors can exhaust the throttler's capacity, preventing further state synchronization and causing epoch bootstrap to fail. This was patched in version 1.7.18 by ensuring the throttler slot is released using a deferred call.

Affected products

• klever-io klever-go < 1.7.18

Timeline

• 2026-05-20: other: Vulnerability observed on develop branch
• 2026-06-02: advisory: GitHub Advisory published
• 2026-06-05: disclosed: CVE-2026-49343 published

References

• https://api.github.com/users/maiiquynhh
• https://github.com/maiiquynhh
• https://api.github.com/users/maiiquynhh/gists%7B/gist_id%7D
• https://api.github.com/users/maiiquynhh/repos
• https://avatars.githubusercontent.com/u/64117178?v=4
• https://api.github.com/users/maiiquynhh/events%7B/privacy%7D