{"id":"EUVD-2026-54716","revision":"c79a9cd9719b47e9aa31c05d8cdde6fe","records":[{"revision":"c79a9cd9719b47e9aa31c05d8cdde6fe","observedAt":"2026-10-30T08:52:35.044+00:00","statement":{"source":"euvd","id":"EUVD-2026-54716","aliases":["CVE-2026-49343","GHSA-fw38-pc54-jvx9"],"title":"Klever-Go is the Go implementation of the Klever blockchain protocol. In versions prior to 1.7.18, the account-data trie syncers are vulnerable to a resource-exhaustion flaw that leaks bounded throttler slots on error paths. In syncDataTrie…","description":"Klever-Go is the Go implementation of the Klever blockchain protocol. In versions prior to 1.7.18, the account-data trie syncers are vulnerable to a resource-exhaustion flaw that leaks bounded throttler slots on error paths. In syncDataTrie() (in both userAccountsSyncer.go and kappAccountsSyncer.go), StartProcessing() reserves a slot from the NumGoRoutinesThrottler, but the corresponding EndProcessing() is only called on the success path and on the duplicate-root early return. As a result, any error from trie.NewTrie(), trie.NewTrieSyncer(), or trieSyncer.StartSyncing() (including the network-dependent timeout path) permanently consumes one slot for the lifetime of the throttler. An attacker who can repeatedly cause trie-node sync failures or timeouts during bootstrap can exhaust the bounded throttler, after which further account-data trie syncs stop making progress and SyncAccounts() returns a timeout. Because epoch bootstrap in syncUserAccountsState() and syncKappAccountsState() aborts on any such error, this causes bootstrap to fail, a core availability issue affecting fresh, restarting, or resyncing nodes and validators. This issue is fixed in version 1.7.18.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","score":5.9,"severity":null}],"references":["https://github.com/klever-io/klever-go/security/advisories/GHSA-fw38-pc54-jvx9","https://github.com/klever-io/klever-go/releases/tag/v1.7.18"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-54716","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 7, 2026, 10:18:18 PM","dateUpdated":"Aug 13, 2026, 6:40:16 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-54716","identifiers":["EUVD-2026-54716","CVE-2026-49343","GHSA-fw38-pc54-jvx9"]},"retained":false,"historicalAffected":[]}],"coverage":[]}