# Klever-Go resource leak in P2P MultiDataInterceptor throttler

Source: https://junglewise.ai/threats/klever-go-resource-leak-in-p2p-multidatainterceptor-throttler-d4b2ec91  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-04. Updated: 2026-06-04  
License: CC BY 4.0 with a link back

Severity: high · CVSS 7.5 · Published 2026-06-04

A vulnerability in the Klever-Go peer-to-peer (P2P) networking component allows an attacker to disable a node's ability to process new data. By sending a series of specially crafted, malformed messages, an attacker can exhaust the system's internal processing slots. This results in a denial-of-service (DoS) condition where the node stops responding to legitimate network traffic until it is restarted.

Technologies: [github.com/klever-io/klever-go (Go)](https://junglewise.ai/threats/technologies/github-com-klever-io-klever-go). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** High severity, with a CVSS score of 7.5, published 4 June 2026.

**Which products and versions are affected?** github.com/klever-io/klever-go (Go) < 1.7.17.

**Is there a fix for This vulnerability?** A patch was published on 1.7.17. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run github.com/klever-io/klever-go (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A resource leak exists in the MultiDataInterceptor.ProcessReceivedMessage function of klever-go. When a P2P message is received, the system calls StartProcessing() to reserve a slot in a global throttler (limited to 100 slots). If the message is marked as compressed but fails decompression (e.g., invalid gzip header), the function returns an error immediately without calling EndProcessing(). This causes a permanent leak of throttler slots. An unauthenticated remote attacker can send approximately 100 malformed compressed batches to exhaust the throttler, causing the node to reject all subsequent P2P messages with a 'system busy' error. The issue is fixed in version 1.7.17 by ensuring the throttler slot is released even on decompression failure.

## Affected products

- klever-io klever-go < 1.7.17

## Timeline

- 2026-05-19: advisory: GitHub advisory published
- 2026-06-04: disclosed: Public disclosure date
- 1.7.17: patched

## References

- [https://api.github.com/users/LoG1331](https://api.github.com/users/LoG1331)
- [https://github.com/LoG1331](https://github.com/LoG1331)
- [https://api.github.com/users/LoG1331/gists%7B/gist_id%7D](https://api.github.com/users/LoG1331/gists%7B/gist_id%7D)
- [https://api.github.com/users/LoG1331/repos](https://api.github.com/users/LoG1331/repos)
- [https://avatars.githubusercontent.com/u/122247560?v=4](https://avatars.githubusercontent.com/u/122247560?v=4)
- [https://api.github.com/users/LoG1331/events%7B/privacy%7D](https://api.github.com/users/LoG1331/events%7B/privacy%7D)

## Related threats

- [Klever-Go unauthenticated WebSocket /subscribe remote DoS](https://junglewise.ai/threats/cve-2026-86065-klever-go-unauthenticated-websocket-subscribe-remote-dos)
- [Klever-Go /log endpoint unauthenticated logging configuration manipulation](https://junglewise.ai/threats/cve-2026-86064-klever-go-log-endpoint-unauthenticated-logging-configuration)
- [Klever-Go Elasticsearch injection via account name](https://junglewise.ai/threats/cve-2026-82409-klever-go-elasticsearch-injection-via-account-name)
- [Klever-Go BLS public key validation bypass in validator registration](https://junglewise.ai/threats/cve-2026-82407-klever-go-bls-public-key-validation-bypass-in-validator)
- [Klever-Go marketplace Buy missing IsClaimed guard](https://junglewise.ai/threats/cve-2026-82406-klever-go-marketplace-buy-missing-isclaimed-guard)