PT-2026-46990 · Klever-Go · Klever-Go

CVE-2026-47249 · Published 2026-06-05 · Updated 2026-06-25

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions klever-go version 1.7.17

Description A connected peer can trigger remote memory and CPU amplification on nodes that accept P2P peer connections. This occurs when a compressed RequestDataType HashArrayType direct request is sent; a small payload of 442 bytes can expand into 200,000 decoded hash entries within the resolver path. The issue stems from the antiflood logic only accounting for the compressed wire size and the Batch.Decompress() function failing to enforce a cap on decoded repeated-field items. Consequently, the TxResolver and TrieNodeResolver preallocate and iterate through these unchecked decoded hashes, leading to significant memory pressure and synchronous CPU work that can exhaust validator resources and affect node availability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-47249

GHSA-W342-MJ6G-V9C4

GO-2026-5685

Affected Products

Klever-Go

References · 5

• https://osv.dev/vulnerability/GHSA-w342-mj6g-v9c4 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-5685 · Vendor Advisory
• https://github.com/klever-io/klever-go · Note
• https://github.com/klever-io/klever-go/releases/tag/v1.7.18 · Note
• https://github.com/klever-io/klever-go/security/advisories/GHSA-w342-mj6g-v9c4 · Note