Hash-Array Amplification Vulnerability in Klever Blockchain Protocol by Klever
CVE-2026-47249

7.5HIGH

Key Information:

Vendor

Klever-io

Status
Klever-go
Vendor
CVE Published:
7 August 2026

What is CVE-2026-47249?

Klever-Go is vulnerable to a hash-array amplification issue where an attacker can leverage the P2P resolver request handling to amplify memory and CPU usage. A single compressed request can cause the resolver to decode an excessive number of hash entries, up to 200,000, while only sending a minimal 442-byte request. This drawback arises because the resolver's antiflood protection fails to limit the number of decoded items, enabling potential resource exhaustion on any node that accepts P2P connections. This issue has been addressed in version 1.7.18.

Affected Version(s)

klever-go < 1.7.18

References

https://github.com/klever-io/klever-go/security/advisorie...
x_refsource_CONFIRM
https://github.com/klever-io/klever-go/releases/tag/v1.7.18
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.