Executive brief
A vulnerability in the Klever-Go peer-to-peer (P2P) networking component allows an attacker to disable a node's ability to process new data. By sending a series of specially crafted, malformed messages, an attacker can exhaust the system's internal processing slots. This results in a denial-of-service (DoS) condition where the node stops responding to legitimate network traffic until it is restarted.
Technical details
A resource leak exists in the MultiDataInterceptor.ProcessReceivedMessage function of klever-go. When a P2P message is received, the system calls StartProcessing() to reserve a slot in a global throttler (limited to 100 slots). If the message is marked as compressed but fails decompression (e.g., invalid gzip header), the function returns an error immediately without calling EndProcessing(). This causes a permanent leak of throttler slots. An unauthenticated remote attacker can send approximately 100 malformed compressed batches to exhaust the throttler, causing the node to reject all subsequent P2P messages with a 'system busy' error. The issue is fixed in version 1.7.17 by ensuring the throttler slot is released even on decompression failure.
Affected products
- klever-io klever-go < 1.7.17
Timeline
- 2026-05-19: advisory: GitHub advisory published
- 2026-06-04: disclosed: Public disclosure date
- 1.7.17: patched