{"id":"EUVD-2026-54716","enisaUuid":"d0764ca6-7a68-3489-baf4-1c049b9c18b4","description":"Klever-Go is the Go implementation of the Klever blockchain protocol. In versions prior to 1.7.18, the account-data trie syncers are vulnerable to a resource-exhaustion flaw that leaks bounded throttler slots on error paths. In syncDataTrie() (in both userAccountsSyncer.go and kappAccountsSyncer.go), StartProcessing() reserves a slot from the NumGoRoutinesThrottler, but the corresponding EndProcessing() is only called on the success path and on the duplicate-root early return. As a result, any error from trie.NewTrie(), trie.NewTrieSyncer(), or trieSyncer.StartSyncing() (including the network-dependent timeout path) permanently consumes one slot for the lifetime of the throttler. An attacker who can repeatedly cause trie-node sync failures or timeouts during bootstrap can exhaust the bounded throttler, after which further account-data trie syncs stop making progress and SyncAccounts() returns a timeout. Because epoch bootstrap in syncUserAccountsState() and syncKappAccountsState() aborts on any such error, this causes bootstrap to fail, a core availability issue affecting fresh, restarting, or resyncing nodes and validators. This issue is fixed in version 1.7.18.","datePublished":"Aug 7, 2026, 10:18:18 PM","dateUpdated":"Aug 13, 2026, 6:40:16 PM","baseScore":5.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/klever-io/klever-go/security/advisories/GHSA-fw38-pc54-jvx9\nhttps://github.com/klever-io/klever-go/releases/tag/v1.7.18\n","aliases":"CVE-2026-49343\nGHSA-fw38-pc54-jvx9\n","assigner":"GitHub_M","epss":0.41,"enisaIdProduct":[{"id":"b762fc5f-f7a2-34f0-96dd-1c32f3074f21","product":{"name":"klever-go","vendor":{"name":"klever-io"}},"product_version":"\u003c 1.7.18"}],"enisaIdVendor":[{"id":"c330731a-b4af-3b78-b8b8-ee3f339cacb8","vendor":{"name":"klever-io"}}],"enisaIdVulnerability":[{"id":"bd2c52e4-b011-3d86-bd0f-2cd6635c6aae","vulnerability":{"id":"GHSA-fw38-pc54-jvx9","description":"Klever-Go KVM: Throttler slot leak in trie account-data sync causes epoch bootstrap / state sync DoS","datePublished":"Jun 5, 2026, 4:40:40 PM","dateUpdated":"Jun 5, 2026, 4:40:40 PM","baseScore":0.0,"references":"https://github.com/klever-io/klever-go/security/advisories/GHSA-fw38-pc54-jvx9\nhttps://github.com/klever-io/klever-go\nhttps://github.com/klever-io/klever-go/releases/tag/v1.7.18\n","enisa_id":"EUVD-2026-54716\n","aliases":"CVE-2026-49343\nGHSA-fw38-pc54-jvx9\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:03 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"dd91dd74-11b0-34b7-afa3-3dcc3ed85980","vulnerability":{"id":"CVE-2026-49343","description":"Klever-Go is the Go implementation of the Klever blockchain protocol. In versions prior to 1.7.18, the account-data trie syncers are vulnerable to a resource-exhaustion flaw that leaks bounded throttler slots on error paths. In syncDataTrie() (in both userAccountsSyncer.go and kappAccountsSyncer.go), StartProcessing() reserves a slot from the NumGoRoutinesThrottler, but the corresponding EndProcessing() is only called on the success path and on the duplicate-root early return. As a result, any error from trie.NewTrie(), trie.NewTrieSyncer(), or trieSyncer.StartSyncing() (including the network-dependent timeout path) permanently consumes one slot for the lifetime of the throttler. An attacker who can repeatedly cause trie-node sync failures or timeouts during bootstrap can exhaust the bounded throttler, after which further account-data trie syncs stop making progress and SyncAccounts() returns a timeout. Because epoch bootstrap in syncUserAccountsState() and syncKappAccountsState() aborts on any such error, this causes bootstrap to fail, a core availability issue affecting fresh, restarting, or resyncing nodes and validators. This issue is fixed in version 1.7.18.","datePublished":"Aug 7, 2026, 10:18:18 PM","dateUpdated":"Aug 13, 2026, 6:40:16 PM","status":"PUBLISHED","baseScore":5.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/klever-io/klever-go/security/advisories/GHSA-fw38-pc54-jvx9\nhttps://github.com/klever-io/klever-go/releases/tag/v1.7.18\n","enisa_id":"EUVD-2026-54716\n","assigner":"GitHub_M","epss":0.41,"dataProcessed":"Nov 1, 2026, 7:19:35 AM","vulnerabilityProduct":[{"id":"16a8da20-cbae-3361-971e-6f6341f7a961","product":{"name":"klever-go","vendor":{"name":"klever-io"}},"product_version":"\u003c 1.7.18"}],"vulnerabilityVendor":[{"id":"118977ac-5807-34f7-b7af-15a94f727a4a","vendor":{"name":"klever-io"}}]}}],"enisaIdAdvisory":[]}