Executive brief
A vulnerability in the Klever blockchain node software allows a single connected peer to overwhelm a node by sending a flood of direct messages. This causes the node to exhaust its system resources by creating an unlimited number of background tasks, potentially leading to a complete service outage or significant performance degradation. This impact can disrupt the node's ability to process legitimate blockchain transactions and participate in the network.
Technical details
The vulnerability exists in the `networkMessenger.directMessageHandler` function within `network/p2p/libp2p/netMessenger.go`. The component spawns a new goroutine for every incoming direct message before any admission control or antiflood logic (such as `ProcessReceivedMessage`) is executed. Because an attacker can control the sequence numbers in `TopicMessage` envelopes to bypass deduplication, they can trigger unbounded goroutine growth. This leads to stack memory exhaustion and increased CPU pressure on the Go scheduler and garbage collector. The issue was addressed in version 1.7.18 by ensuring message processing is properly bounded or synchronized.
Affected products
- klever-io klever-go >= 1.7.14, <= 1.7.17
Timeline
- 2026-05-13: disclosed: Reported to security@klever.org
- 2026-06-02: patched: Version 1.7.18 released
- 2026-06-05: advisory