CVE-2026-47249 Overview
CVE-2026-47249 is a resource exhaustion vulnerability in Klever-Go, the Go implementation of the Klever blockchain protocol. The flaw resides in the peer-to-peer (P2P) resolver request handling logic and allows hash-array amplification attacks against any node accepting P2P peer connections. A connected peer can transmit a compressed RequestDataType_HashArrayType request of only 442 bytes that decodes into 200,000 hash entries. Both TxResolver and TrieNodeResolver preallocate and iterate over the entire decoded set, producing remote memory and CPU amplification. The issue is fixed in Klever-Go version 1.7.18.
Critical Impact
A single 442-byte compressed request expands to 200,000 hash entries, enabling remote attackers to exhaust memory and CPU on any node accepting P2P connections without authentication.
Affected Products
- Klever-Go versions prior to 1.7.18
- Klever blockchain protocol nodes accepting P2P peer connections
- Deployments exposing TxResolver or TrieNodeResolver endpoints
Discovery Timeline
- 2026-08-07 - CVE-2026-47249 published to NVD
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-47249
Vulnerability Analysis
The vulnerability is an algorithmic complexity and resource exhaustion issue classified under [CWE-400]. The Klever-Go P2P layer accepts compressed request messages of type RequestDataType_HashArrayType. Attackers exploit the disparity between the wire-format byte count and the number of decoded protobuf repeated-field elements. The resolver's antiflood mechanism counts messages by logical count and compressed wire size only. It does not enforce an upper bound on the number of decoded hash entries carried inside a single request.
Once decoded, both TxResolver and TrieNodeResolver preallocate slices sized to the attacker-controlled entry count. Each node then iterates the full 200,000-entry array, performing lookups per hash. Concurrent requests from one or a few peers compound the memory footprint and CPU load, degrading or halting node operation.
Root Cause
The root cause is missing input validation on the count of decoded repeated-field items in compressed P2P messages. Batch.Decompress() caps the total decompressed byte size but never limits how many discrete hash entries are unpacked. The antiflood counters therefore see one small message while the resolver processes an unbounded array of hashes.
Attack Vector
Exploitation requires only network reachability to a target node's P2P listener. No authentication or user interaction is needed. An attacker connects as a peer and sends a crafted, highly compressible RequestDataType_HashArrayType message containing repeated hash entries. The compressed payload passes antiflood checks, decodes into 200,000 entries, and forces the resolver to allocate and iterate the full array. Repeated sends amplify impact against availability.
See the GitHub Security Advisory GHSA-w342-mj6g-v9c4 for the vendor's technical description.
Detection Methods for CVE-2026-47249
Indicators of Compromise
- Sudden spikes in memory allocation within Klever-Go node processes, particularly inside TxResolver or TrieNodeResolver code paths.
- Sustained CPU saturation correlated with inbound P2P traffic from a small number of peers.
- Log entries showing large decoded hash-array counts from RequestDataType_HashArrayType messages despite low wire byte counts.
- Node unresponsiveness, missed block propagation, or peer disconnections coinciding with amplified requests.
Detection Strategies
- Monitor Klever-Go process memory and garbage collection metrics for anomalous growth tied to resolver requests.
- Instrument the P2P layer to log the decoded item count of HashArrayType requests alongside their compressed size.
- Alert on peers whose average compression ratio for resolver requests exceeds normal baselines.
Monitoring Recommendations
- Track per-peer request rates and decoded-entry totals to identify amplification patterns.
- Correlate node performance metrics with network flow data to attribute resource spikes to specific peers.
- Ingest node telemetry into a centralized platform to detect coordinated abuse across a validator fleet.
How to Mitigate CVE-2026-47249
Immediate Actions Required
- Upgrade all Klever-Go nodes to version 1.7.18 or later, which enforces limits on decoded hash-array entries.
- Audit peer connections and disconnect peers exhibiting abnormal resolver request patterns.
- Apply network-level rate limits and connection quotas at the P2P listener until patched builds are deployed.
Patch Information
The vendor released the fix in Klever-Go v1.7.18. The patch caps the number of decoded repeated-field items processed by the resolver so that a single message cannot expand into an unbounded hash array. Operators should validate binary integrity and restart nodes after upgrade.
Workarounds
- Restrict P2P listener exposure to trusted peer allowlists where operationally feasible.
- Deploy reverse proxies or firewalls that enforce strict per-peer bandwidth and connection limits.
- Reduce process memory limits and enable automatic restart supervision to contain amplification impact until the patch is applied.
# Configuration example: upgrade Klever-Go to the patched release
git fetch --tags
git checkout v1.7.18
make build
systemctl restart klever-go-node
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
