Resource Exhaustion Vulnerability in Klever-Go Blockchain Protocol
CVE-2026-49343

5.9MEDIUM

Key Information:

Vendor

Klever-io

Status
Klever-go
Vendor
CVE Published:
7 August 2026

What is CVE-2026-49343?

The Klever-Go implementation of the Klever blockchain protocol is susceptible to a resource exhaustion vulnerability affecting the account-data trie syncers. In versions before 1.7.18, the syncDataTrie() function fails to properly manage throttler slots in cases of error. Specifically, while StartProcessing() reserves a slot, EndProcessing() is only called during successful operations. This oversight leads to permanent slot consumption upon encountering errors during trie-node synchronization. Consequently, repeated sync failures can exhaust the throttler, halting all account-data trie sync operations, which results in critical availability issues for nodes and validators during bootstrap processes.

Affected Version(s)

klever-go < 1.7.18

References

https://github.com/klever-io/klever-go/security/advisorie...
x_refsource_CONFIRM
https://github.com/klever-io/klever-go/releases/tag/v1.7.18
x_refsource_MISC

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.