CVE-2026-47249 Details
Description
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.18, the P2P resolver request handling logic is vulnerable to hash-array amplification. A connected peer can send a compressed RequestDataType_HashArrayType direct request that is only 442 bytes on the wire but expands into 200,000 decoded hash entries inside the resolver path. The resolver's antiflood logic counts only a single logical message and the compressed wire size, and while Batch.Decompress() caps the decompressed byte size, it never limits the number of decoded repeated-field items. As a result, both TxResolver and TrieNodeResolver preallocate and iterate over the entire unchecked set of decoded hashes, causing remote memory and CPU amplification against any node that accepts P2P peer connections. This issue is fixed in version 1.7.18.
A hash-array amplification vulnerability has been identified in Klever-Go versions prior to 1.7.18. The issue arises in the P2P resolver request handling, where a connected peer can send a compressed direct request that is only 442 bytes on the wire. However, this request expands to 200,000 decoded hash entries within the resolver path. The amplification occurs because the resolver's antiflood logic only counts a single logical message and the compressed wire size, allowing a small payload to create significant memory and CPU strain on the target node. This vulnerability is particularly impactful on nodes that accept P2P peer connections.
Users are advised to upgrade to Klever-Go version 1.7.18, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 7, 2026CISA-ADP
Assessed Aug 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/klever-io/klever-go/releases/tag/v1.7.18 | [email protected] | Release NotesVendor |
| https://github.com/klever-io/klever-go/security/advisories/GHSA-w342-mj6g-v9c4 | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Klever-Go | < 1.7.17 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 10, 2026 | CVE Modified | CISA-ADP |
| Aug 7, 2026 | New CVE Received | [email protected] |