CVE-2026-47249

{
  "id": "CVE-2026-47249",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-07T23:17:03.670",
  "lastModified": "2026-10-23T20:10:00.160",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.18, the P2P resolver request handling logic is vulnerable to hash-array amplification. A connected peer can send a compressed RequestDataType_HashArrayType direct request that is only 442 bytes on the wire but expands into 200,000 decoded hash entries inside the resolver path. The resolver's antiflood logic counts only a single logical message and the compressed wire size, and while Batch.Decompress() caps the decompressed byte size, it never limits the number of decoded repeated-field items. As a result, both TxResolver and TrieNodeResolver preallocate and iterate over the entire unchecked set of decoded hashes, causing remote memory and CPU amplification against any node that accepts P2P peer connections. This issue is fixed in version 1.7.18."
    },
    {
      "lang": "es",
      "value": "Klever-Go es la implementación en Go del protocolo de cadena de bloques Klever. Antes de la versión 1.7.18, la lógica de manejo de solicitudes del resolvedor P2P es vulnerable a la amplificación de arreglos de hashes. Un par conectado puede enviar una solicitud directa comprimida de tipo RequestDataType_HashArrayType que tiene solo 442 bytes en el cable, pero se expande a 200.000 entradas de hash decodificadas dentro de la ruta del resolvedor. La lógica anti-inundación del resolvedor cuenta solo un único mensaje lógico y el tamaño comprimido en el cable, y aunque Batch.Decompress() limita el tamaño de bytes descomprimidos, nunca limita el número de elementos de campo repetidos decodificados. Como resultado, tanto TxResolver como TrieNodeResolver preasignan e iteran sobre todo el conjunto no verificado de hashes decodificados, causando amplificación remota de memoria y CPU contra cualquier nodo que acepte conexiones de pares P2P. Este problema está solucionado en la versión 1.7.18."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "klever-io",
          "product": "klever-go",
          "versions": [
            {
              "version": "< 1.7.18",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-10T14:07:15.833735Z",
          "id": "CVE-2026-47249",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/klever-io/klever-go/releases/tag/v1.7.18",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/klever-io/klever-go/security/advisories/GHSA-w342-mj6g-v9c4",
      "source": "[email protected]"
    }
  ]
}