CVE-2026-47249

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-47249", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-18T22:54:18.273Z", "datePublished": "2026-08-07T22:09:03.931Z", "dateUpdated": "2026-08-10T14:07:38.266Z"}, "containers": {"cna": {"title": "Klever-Go KVM: Hash-array amplification in P2P resolver request handling", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/klever-io/klever-go/security/advisories/GHSA-w342-mj6g-v9c4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/klever-io/klever-go/security/advisories/GHSA-w342-mj6g-v9c4"}, {"name": "https://github.com/klever-io/klever-go/releases/tag/v1.7.18", "tags": ["x_refsource_MISC"], "url": "https://github.com/klever-io/klever-go/releases/tag/v1.7.18"}], "affected": [{"vendor": "klever-io", "product": "klever-go", "versions": [{"version": "< 1.7.18", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-07T22:09:03.931Z"}, "descriptions": [{"lang": "en", "value": "Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.18, the P2P resolver request handling logic is vulnerable to hash-array amplification. A connected peer can send a compressed RequestDataType_HashArrayType direct request that is only 442 bytes on the wire but expands into 200,000 decoded hash entries inside the resolver path. The resolver's antiflood logic counts only a single logical message and the compressed wire size, and while Batch.Decompress() caps the decompressed byte size, it never limits the number of decoded repeated-field items. As a result, both TxResolver and TrieNodeResolver preallocate and iterate over the entire unchecked set of decoded hashes, causing remote memory and CPU amplification against any node that accepts P2P peer connections. This issue is fixed in version 1.7.18."}], "source": {"advisory": "GHSA-w342-mj6g-v9c4", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-10T14:07:15.833735Z", "id": "CVE-2026-47249", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-10T14:07:38.266Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-47249", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-10T14:07:15.833735Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-10T14:07:29.536Z"}}], "cna": {"title": "Klever-Go KVM: Hash-array amplification in P2P resolver request handling", "source": {"advisory": "GHSA-w342-mj6g-v9c4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "klever-io", "product": "klever-go", "versions": [{"status": "affected", "version": "< 1.7.18"}]}], "references": [{"url": "https://github.com/klever-io/klever-go/security/advisories/GHSA-w342-mj6g-v9c4", "name": "https://github.com/klever-io/klever-go/security/advisories/GHSA-w342-mj6g-v9c4", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/klever-io/klever-go/releases/tag/v1.7.18", "name": "https://github.com/klever-io/klever-go/releases/tag/v1.7.18", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.18, the P2P resolver request handling logic is vulnerable to hash-array amplification. A connected peer can send a compressed RequestDataType_HashArrayType direct request that is only 442 bytes on the wire but expands into 200,000 decoded hash entries inside the resolver path. The resolver's antiflood logic counts only a single logical message and the compressed wire size, and while Batch.Decompress() caps the decompressed byte size, it never limits the number of decoded repeated-field items. As a result, both TxResolver and TrieNodeResolver preallocate and iterate over the entire unchecked set of decoded hashes, causing remote memory and CPU amplification against any node that accepts P2P peer connections. This issue is fixed in version 1.7.18."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-07T22:09:03.931Z"}}}, "cveMetadata": {"cveId": "CVE-2026-47249", "state": "PUBLISHED", "dateUpdated": "2026-08-10T14:07:38.266Z", "dateReserved": "2026-05-18T22:54:18.273Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-07T22:09:03.931Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "klever-go", "vendor": "klever-io", "versions": [{"status": "affected", "version": "< 1.7.18"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.18, the P2P resolver request handling logic is vulnerable to hash-array amplification. A connected peer can send a compressed RequestDataType_HashArrayType direct request that is only 442 bytes on the wire but expands into 200,000 decoded hash entries inside the resolver path. The resolver's antiflood logic counts only a single logical message and the compressed wire size, and while Batch.Decompress() caps the decompressed byte size, it never limits the number of decoded repeated-field items. As a result, both TxResolver and TrieNodeResolver preallocate and iterate over the entire unchecked set of decoded hashes, causing remote memory and CPU amplification against any node that accepts P2P peer connections. This issue is fixed in version 1.7.18."}, {"lang": "es", "value": "Klever-Go es la implementaci\u00f3n en Go del protocolo de cadena de bloques Klever. Antes de la versi\u00f3n 1.7.18, la l\u00f3gica de manejo de solicitudes del resolvedor P2P es vulnerable a la amplificaci\u00f3n de arreglos de hashes. Un par conectado puede enviar una solicitud directa comprimida de tipo RequestDataType_HashArrayType que tiene solo 442 bytes en el cable, pero se expande a 200.000 entradas de hash decodificadas dentro de la ruta del resolvedor. La l\u00f3gica anti-inundaci\u00f3n del resolvedor cuenta solo un \u00fanico mensaje l\u00f3gico y el tama\u00f1o comprimido en el cable, y aunque Batch.Decompress() limita el tama\u00f1o de bytes descomprimidos, nunca limita el n\u00famero de elementos de campo repetidos decodificados. Como resultado, tanto TxResolver como TrieNodeResolver preasignan e iteran sobre todo el conjunto no verificado de hashes decodificados, causando amplificaci\u00f3n remota de memoria y CPU contra cualquier nodo que acepte conexiones de pares P2P. Este problema est\u00e1 solucionado en la versi\u00f3n 1.7.18."}], "id": "CVE-2026-47249", "lastModified": "2026-10-23T20:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47249", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-10T14:07:15.833735Z", "version": "2.0.3"}}]}, "published": "2026-08-07T23:17:03.670", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/klever-io/klever-go/releases/tag/v1.7.18"}, {"source": "security-advisories@github.com", "url": "https://github.com/klever-io/klever-go/security/advisories/GHSA-w342-mj6g-v9c4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.7.18)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "klever-go", "source": "cna", "vendor": "klever-io"}, "product": "klever-go", "vendor": "klever-io"}], "created": "2026-08-07T23:30:17.447240+00:00", "updated": "2026-08-07T23:30:17.650885+00:00", "vendors": ["klever-io", "klever-io$PRODUCT$klever-go"]}