{"id":"EUVD-2026-54720","enisaUuid":"7a7a567d-f058-3ba9-968d-7327233a7613","description":"Klever-Go is the Go implementation of the Klever blockchain protocol. In versions 1.7.14 through 1.7.17, the direct-message ingress handler spawns a new goroutine for every incoming direct message before the processor-level antiflood layer makes any admission decision, with no semaphore, throttler, or bound on the number of concurrent in-flight spawns. Because the antiflood check runs inside the spawned goroutine rather than before it, a single connected peer can open a direct-send stream and send a stream of well-formed messages to force unbounded goroutine creation, where each goroutine allocates its own stack and holds a message reference until processing completes, adding scheduler and garbage-collection pressure faster than the runtime can drain it. This lets one peer degrade the node\u0027s availability and its ability to process legitimate traffic, resulting in a remotely triggerable denial of service. The issue is fixed in 1.7.18.","datePublished":"Aug 7, 2026, 10:36:53 PM","dateUpdated":"Aug 10, 2026, 1:36:07 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/klever-io/klever-go/security/advisories/GHSA-hf2g-6j7h-98wg\nhttps://github.com/klever-io/klever-go/releases/tag/v1.7.18\n","aliases":"CVE-2026-52879\nGHSA-hf2g-6j7h-98wg\n","assigner":"GitHub_M","epss":0.49,"enisaIdProduct":[{"id":"735d8943-4004-379d-9d1e-c10e636662f8","product":{"name":"klever-go","vendor":{"name":"klever-io"}},"product_version":"1.7.14, \u003c 1.7.18"}],"enisaIdVendor":[{"id":"bb68e223-02b6-3ffb-914c-ad2e845f5e4e","vendor":{"name":"klever-io"}}],"enisaIdVulnerability":[{"id":"4403f537-0702-3dc1-b669-01627aa563a9","vulnerability":{"id":"CVE-2026-52879","description":"Klever-Go is the Go implementation of the Klever blockchain protocol. In versions 1.7.14 through 1.7.17, the direct-message ingress handler spawns a new goroutine for every incoming direct message before the processor-level antiflood layer makes any admission decision, with no semaphore, throttler, or bound on the number of concurrent in-flight spawns. Because the antiflood check runs inside the spawned goroutine rather than before it, a single connected peer can open a direct-send stream and send a stream of well-formed messages to force unbounded goroutine creation, where each goroutine allocates its own stack and holds a message reference until processing completes, adding scheduler and garbage-collection pressure faster than the runtime can drain it. This lets one peer degrade the node\u0027s availability and its ability to process legitimate traffic, resulting in a remotely triggerable denial of service. The issue is fixed in 1.7.18.","datePublished":"Aug 7, 2026, 10:36:53 PM","dateUpdated":"Aug 10, 2026, 1:36:07 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/klever-io/klever-go/security/advisories/GHSA-hf2g-6j7h-98wg\nhttps://github.com/klever-io/klever-go/releases/tag/v1.7.18\n","enisa_id":"EUVD-2026-54720\n","assigner":"GitHub_M","epss":0.49,"dataProcessed":"Oct 30, 2026, 7:16:05 AM","vulnerabilityProduct":[{"id":"196b6c2d-d1e9-3d4c-b37c-add74a5aefd1","product":{"name":"klever-go","vendor":{"name":"klever-io"}},"product_version":"1.7.14, \u003c 1.7.18"}],"vulnerabilityVendor":[{"id":"8410aae8-2d99-3fa7-afe3-16b0e7dd9eaf","vendor":{"name":"klever-io"}}]}},{"id":"a3fa65db-fe85-360c-97d2-13d34cf09f11","vulnerability":{"id":"GHSA-hf2g-6j7h-98wg","description":"klever-go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoS","datePublished":"Jun 5, 2026, 4:41:23 PM","dateUpdated":"Jun 9, 2026, 6:40:40 PM","baseScore":0.0,"references":"https://github.com/klever-io/klever-go/security/advisories/GHSA-hf2g-6j7h-98wg\nhttps://github.com/klever-io/klever-go\nhttps://github.com/klever-io/klever-go/releases/tag/v1.7.18\n","enisa_id":"EUVD-2026-54720\n","aliases":"CVE-2026-52879\nGHSA-hf2g-6j7h-98wg\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:56:29 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}