CVE-2026-49343

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-49343", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-29T14:35:45.903Z", "datePublished": "2026-08-07T22:18:18.735Z", "dateUpdated": "2026-08-13T18:40:16.330Z"}, "containers": {"cna": {"title": "Klever-Go KVM: Throttler slot leak in trie account-data sync causes epoch bootstrap / state sync DoS", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-772", "lang": "en", "description": "CWE-772: Missing Release of Resource after Effective Lifetime", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/klever-io/klever-go/security/advisories/GHSA-fw38-pc54-jvx9", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/klever-io/klever-go/security/advisories/GHSA-fw38-pc54-jvx9"}, {"name": "https://github.com/klever-io/klever-go/releases/tag/v1.7.18", "tags": ["x_refsource_MISC"], "url": "https://github.com/klever-io/klever-go/releases/tag/v1.7.18"}], "affected": [{"vendor": "klever-io", "product": "klever-go", "versions": [{"version": "< 1.7.18", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-07T22:18:18.735Z"}, "descriptions": [{"lang": "en", "value": "Klever-Go is the Go implementation of the Klever blockchain protocol. In versions prior to 1.7.18, the account-data trie syncers are vulnerable to a resource-exhaustion flaw that leaks bounded throttler slots on error paths. In syncDataTrie() (in both userAccountsSyncer.go and kappAccountsSyncer.go), StartProcessing() reserves a slot from the NumGoRoutinesThrottler, but the corresponding EndProcessing() is only called on the success path and on the duplicate-root early return. As a result, any error from trie.NewTrie(), trie.NewTrieSyncer(), or trieSyncer.StartSyncing() (including the network-dependent timeout path) permanently consumes one slot for the lifetime of the throttler. An attacker who can repeatedly cause trie-node sync failures or timeouts during bootstrap can exhaust the bounded throttler, after which further account-data trie syncs stop making progress and SyncAccounts() returns a timeout. Because epoch bootstrap in syncUserAccountsState() and syncKappAccountsState() aborts on any such error, this causes bootstrap to fail, a core availability issue affecting fresh, restarting, or resyncing nodes and validators. This issue is fixed in version 1.7.18."}], "source": {"advisory": "GHSA-fw38-pc54-jvx9", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/klever-io/klever-go/security/advisories/GHSA-fw38-pc54-jvx9", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-13T18:40:07.764602Z", "id": "CVE-2026-49343", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T18:40:16.330Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-49343", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-13T18:40:07.764602Z"}}}], "references": [{"url": "https://github.com/klever-io/klever-go/security/advisories/GHSA-fw38-pc54-jvx9", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T18:39:49.603Z"}}], "cna": {"title": "Klever-Go KVM: Throttler slot leak in trie account-data sync causes epoch bootstrap / state sync DoS", "source": {"advisory": "GHSA-fw38-pc54-jvx9", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "klever-io", "product": "klever-go", "versions": [{"status": "affected", "version": "< 1.7.18"}]}], "references": [{"url": "https://github.com/klever-io/klever-go/security/advisories/GHSA-fw38-pc54-jvx9", "name": "https://github.com/klever-io/klever-go/security/advisories/GHSA-fw38-pc54-jvx9", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/klever-io/klever-go/releases/tag/v1.7.18", "name": "https://github.com/klever-io/klever-go/releases/tag/v1.7.18", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Klever-Go is the Go implementation of the Klever blockchain protocol. In versions prior to 1.7.18, the account-data trie syncers are vulnerable to a resource-exhaustion flaw that leaks bounded throttler slots on error paths. In syncDataTrie() (in both userAccountsSyncer.go and kappAccountsSyncer.go), StartProcessing() reserves a slot from the NumGoRoutinesThrottler, but the corresponding EndProcessing() is only called on the success path and on the duplicate-root early return. As a result, any error from trie.NewTrie(), trie.NewTrieSyncer(), or trieSyncer.StartSyncing() (including the network-dependent timeout path) permanently consumes one slot for the lifetime of the throttler. An attacker who can repeatedly cause trie-node sync failures or timeouts during bootstrap can exhaust the bounded throttler, after which further account-data trie syncs stop making progress and SyncAccounts() returns a timeout. Because epoch bootstrap in syncUserAccountsState() and syncKappAccountsState() aborts on any such error, this causes bootstrap to fail, a core availability issue affecting fresh, restarting, or resyncing nodes and validators. This issue is fixed in version 1.7.18."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-772", "description": "CWE-772: Missing Release of Resource after Effective Lifetime"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-07T22:18:18.735Z"}}}, "cveMetadata": {"cveId": "CVE-2026-49343", "state": "PUBLISHED", "dateUpdated": "2026-08-13T18:40:16.330Z", "dateReserved": "2026-05-29T14:35:45.903Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-07T22:18:18.735Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "klever-go", "vendor": "klever-io", "versions": [{"status": "affected", "version": "< 1.7.18"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Klever-Go is the Go implementation of the Klever blockchain protocol. In versions prior to 1.7.18, the account-data trie syncers are vulnerable to a resource-exhaustion flaw that leaks bounded throttler slots on error paths. In syncDataTrie() (in both userAccountsSyncer.go and kappAccountsSyncer.go), StartProcessing() reserves a slot from the NumGoRoutinesThrottler, but the corresponding EndProcessing() is only called on the success path and on the duplicate-root early return. As a result, any error from trie.NewTrie(), trie.NewTrieSyncer(), or trieSyncer.StartSyncing() (including the network-dependent timeout path) permanently consumes one slot for the lifetime of the throttler. An attacker who can repeatedly cause trie-node sync failures or timeouts during bootstrap can exhaust the bounded throttler, after which further account-data trie syncs stop making progress and SyncAccounts() returns a timeout. Because epoch bootstrap in syncUserAccountsState() and syncKappAccountsState() aborts on any such error, this causes bootstrap to fail, a core availability issue affecting fresh, restarting, or resyncing nodes and validators. This issue is fixed in version 1.7.18."}, {"lang": "es", "value": "Klever-Go es la implementaci\u00f3n en Go del protocolo de cadena de bloques Klever. En versiones anteriores a la 1.7.18, los sincronizadores de trie de datos de cuenta son vulnerables a una falla de agotamiento de recursos que filtra ranuras de limitador acotado en rutas de error. En syncDataTrie() (tanto en userAccountsSyncer.go como en kappAccountsSyncer.go), StartProcessing() reserva una ranura del NumGoRoutinesThrottler, pero el EndProcessing() correspondiente solo se llama en la ruta de \u00e9xito y en el retorno anticipado por ra\u00edz duplicada. Como resultado, cualquier error de trie.NewTrie(), trie.NewTrieSyncer() o trieSyncer.StartSyncing() (incluida la ruta de tiempo de espera dependiente de la red) consume permanentemente una ranura durante la vida \u00fatil del limitador. Un atacante que puede causar repetidamente fallas de sincronizaci\u00f3n o tiempos de espera de nodos trie durante el arranque puede agotar el limitador acotado, despu\u00e9s de lo cual las sincronizaciones posteriores de trie de datos de cuenta dejan de progresar y SyncAccounts() devuelve un tiempo de espera. Debido a que el arranque de \u00e9poca en syncUserAccountsState() y syncKappAccountsState() aborta ante cualquier error de este tipo, esto hace que el arranque falle, un problema central de disponibilidad que afecta a nodos y validadores nuevos, que se reinician o que se resincronizan. Este problema se corrige en la versi\u00f3n 1.7.18."}], "id": "CVE-2026-49343", "lastModified": "2026-10-24T16:10:00.153", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49343", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-13T18:40:07.764602Z", "version": "2.0.3"}}]}, "published": "2026-08-07T23:17:04.450", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/klever-io/klever-go/releases/tag/v1.7.18"}, {"source": "security-advisories@github.com", "url": "https://github.com/klever-io/klever-go/security/advisories/GHSA-fw38-pc54-jvx9"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/klever-io/klever-go/security/advisories/GHSA-fw38-pc54-jvx9"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-772"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.7.18)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "klever-go", "source": "cna", "vendor": "klever-io"}, "product": "klever-go", "vendor": "klever-io"}], "created": "2026-08-07T23:30:17.447058+00:00", "updated": "2026-08-07T23:30:17.650237+00:00", "vendors": ["klever-io", "klever-io$PRODUCT$klever-go"]}