{"cve":"CVE-2026-47249","nvd":{"published":"2026-08-07T23:17:03.670","modified":"2026-10-23T20:10:00.160","status":"Deferred","description":"Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.18, the P2P resolver request handling logic is vulnerable to hash-array amplification. A connected peer can send a compressed RequestDataType_HashArrayType direct request that is only 442 bytes on the wire but expands into 200,000 decoded hash entries inside the resolver path. The resolver's antiflood logic counts only a single logical message and the compressed wire size, and while Batch.Decompress() caps the decompressed byte size, it never limits the number of decoded repeated-field items. As a result, both TxResolver and TrieNodeResolver preallocate and iterate over the entire unchecked set of decoded hashes, causing remote memory and CPU amplification against any node that accepts P2P peer connections. This issue is fixed in version 1.7.18.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-400"],"references":["https://github.com/klever-io/klever-go/releases/tag/v1.7.18","https://github.com/klever-io/klever-go/security/advisories/GHSA-w342-mj6g-v9c4"],"products":[],"source":"nvd","synced_at":"2026-10-24T16:53:34.184483516+00:00"},"epss":{"cve":"CVE-2026-47249","score":0.00488,"percentile":0.41697,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-w342-mj6g-v9c4","url":"https://osv.dev/vulnerability/GHSA-w342-mj6g-v9c4","summary":"Klever-Go KVM: Hash-array amplification in P2P resolver request handling","modified":"2026-06-25T23:11:07.054831801Z","packages":[{"ecosystem":"Go","name":"github.com/klever-io/klever-go","purl":"pkg:golang/github.com/klever-io/klever-go","ranges":["<1.7.18"],"fixed":["1.7.18"]}]},{"id":"GO-2026-5685","url":"https://osv.dev/vulnerability/GO-2026-5685","summary":"Klever-Go KVM: Hash-array amplification in P2P resolver request handling in github.com/klever-io/klever-go","modified":"2026-06-25T23:01:26.824375093Z","packages":[{"ecosystem":"Go","name":"github.com/klever-io/klever-go","purl":"pkg:golang/github.com/klever-io/klever-go","ranges":["<1.7.18"],"fixed":["1.7.18"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}