{"id":"EUVD-2026-54720","revision":"128fab87f40b4b6c90b4c2c6f091f934","records":[{"revision":"128fab87f40b4b6c90b4c2c6f091f934","observedAt":"2026-11-01T09:15:02.223+00:00","statement":{"source":"euvd","id":"EUVD-2026-54720","aliases":["CVE-2026-52879","GHSA-hf2g-6j7h-98wg"],"title":"Klever-Go is the Go implementation of the Klever blockchain protocol. In versions 1.7.14 through 1.7.17, the direct-message ingress handler spawns a new goroutine for every incoming direct message before the processor-level antiflood layer …","description":"Klever-Go is the Go implementation of the Klever blockchain protocol. In versions 1.7.14 through 1.7.17, the direct-message ingress handler spawns a new goroutine for every incoming direct message before the processor-level antiflood layer makes any admission decision, with no semaphore, throttler, or bound on the number of concurrent in-flight spawns. Because the antiflood check runs inside the spawned goroutine rather than before it, a single connected peer can open a direct-send stream and send a stream of well-formed messages to force unbounded goroutine creation, where each goroutine allocates its own stack and holds a message reference until processing completes, adding scheduler and garbage-collection pressure faster than the runtime can drain it. This lets one peer degrade the node's availability and its ability to process legitimate traffic, resulting in a remotely triggerable denial of service. The issue is fixed in 1.7.18.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":null}],"references":["https://github.com/klever-io/klever-go/security/advisories/GHSA-hf2g-6j7h-98wg","https://github.com/klever-io/klever-go/releases/tag/v1.7.18"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-54720","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 7, 2026, 10:36:53 PM","dateUpdated":"Aug 10, 2026, 1:36:07 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-54720","identifiers":["EUVD-2026-54720","CVE-2026-52879","GHSA-hf2g-6j7h-98wg"]},"retained":false,"historicalAffected":[]}],"coverage":[]}