Most recent entries from all

EUVD-2026-352287

2026-10-06T17:06:05.376930+00:00

EUVD-2026-352287

fkie_cve-2026-49343

2026-10-06T17:06:05.376970+00:00

Klever-Go is the Go implementation of the Klever blockchain protocol. In versions prior to 1.7.18, the account-data trie syncers are vulnerable to a resource-exhaustion flaw that leaks bounded throttler slots on error paths. In syncDataTrie() (in both userAccountsSyncer.go and kappAccountsSyncer.go), StartProcessing() reserves a slot from the NumGoRoutinesThrottler, but the corresponding EndProcessing() is only called on the success path and on the duplicate-root early return. As a result, any error from trie.NewTrie(), trie.NewTrieSyncer(), or trieSyncer.StartSyncing() (including the network-dependent timeout path) permanently consumes one slot for the lifetime of the throttler. An attacker who can repeatedly cause trie-node sync failures or timeouts during bootstrap can exhaust the bounded throttler, after which further account-data trie syncs stop making progress and SyncAccounts() returns a timeout. Because epoch bootstrap in syncUserAccountsState() and syncKappAccountsState() aborts on any such error, this causes bootstrap to fail, a core availability issue affecting fresh, restarting, or resyncing nodes and validators. This issue is fixed in version 1.7.18.

GHSA-fw38-pc54-jvx9 — Klever-Go KVM: Throttler slot leak in trie account-data sync causes epoch bootstrap / state sync DoS

2026-10-06T17:06:05.377010+00:00

Affected: Go: github.com/klever-io/klever-go

## Summary

The account-data trie syncers leak bounded throttler slots on error paths in `syncDataTrie()`. Each failed trie sync permanently consumes one slot from the `NumGoRoutinesThrottler`, and the slot is never returned unless the sync succeeds or the root hash was already present.

I confirmed this on the current default branch `develop` at commit `9640d63` (observed on May 20, 2026). I also confirmed the bug with a runtime PoC using the real timeout path in `trieSyncer.StartSyncing()`: two timed-out sync attempts are enough to exhaust a throttler with capacity `2`.

This affects the epoch bootstrap path because `syncUserAccountsState()` and `syncKappAccountsState()` create bounded throttlers and abort bootstrap immediately if the syncer returns an error. Once enough trie-root sync attempts fail, the syncer cannot make forward progress and bootstrap fails.

## Affected Components

- `data/syncer/userAccountsSyncer.go` - `data/syncer/kappAccountsSyncer.go` - `data/trie/sync.go` - `core/throttler/numGoRoutinesThrottler.go` - `core/bootstrap/process.go`

## Affected Version

Verified on: - `develop` HEAD `9640d63`

Please check whether the same code is present in supported `1.7.x` releases.

## Suggested Severity

High

## Vulnerability Details

### Root Cause

Both account-data syncers call `StartProcessing()` before creating / starting the trie syncer, but they only call `EndProcessing()` on the success path and on the duplica…