CVE-2026-49343

{
  "id": "CVE-2026-49343",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-07T23:17:04.450",
  "lastModified": "2026-10-24T16:10:00.153",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Klever-Go is the Go implementation of the Klever blockchain protocol. In versions prior to 1.7.18, the account-data trie syncers are vulnerable to a resource-exhaustion flaw that leaks bounded throttler slots on error paths. In syncDataTrie() (in both userAccountsSyncer.go and kappAccountsSyncer.go), StartProcessing() reserves a slot from the NumGoRoutinesThrottler, but the corresponding EndProcessing() is only called on the success path and on the duplicate-root early return. As a result, any error from trie.NewTrie(), trie.NewTrieSyncer(), or trieSyncer.StartSyncing() (including the network-dependent timeout path) permanently consumes one slot for the lifetime of the throttler. An attacker who can repeatedly cause trie-node sync failures or timeouts during bootstrap can exhaust the bounded throttler, after which further account-data trie syncs stop making progress and SyncAccounts() returns a timeout. Because epoch bootstrap in syncUserAccountsState() and syncKappAccountsState() aborts on any such error, this causes bootstrap to fail, a core availability issue affecting fresh, restarting, or resyncing nodes and validators. This issue is fixed in version 1.7.18."
    },
    {
      "lang": "es",
      "value": "Klever-Go es la implementación en Go del protocolo de cadena de bloques Klever. En versiones anteriores a la 1.7.18, los sincronizadores de trie de datos de cuenta son vulnerables a una falla de agotamiento de recursos que filtra ranuras de limitador acotado en rutas de error. En syncDataTrie() (tanto en userAccountsSyncer.go como en kappAccountsSyncer.go), StartProcessing() reserva una ranura del NumGoRoutinesThrottler, pero el EndProcessing() correspondiente solo se llama en la ruta de éxito y en el retorno anticipado por raíz duplicada. Como resultado, cualquier error de trie.NewTrie(), trie.NewTrieSyncer() o trieSyncer.StartSyncing() (incluida la ruta de tiempo de espera dependiente de la red) consume permanentemente una ranura durante la vida útil del limitador. Un atacante que puede causar repetidamente fallas de sincronización o tiempos de espera de nodos trie durante el arranque puede agotar el limitador acotado, después de lo cual las sincronizaciones posteriores de trie de datos de cuenta dejan de progresar y SyncAccounts() devuelve un tiempo de espera. Debido a que el arranque de época en syncUserAccountsState() y syncKappAccountsState() aborta ante cualquier error de este tipo, esto hace que el arranque falle, un problema central de disponibilidad que afecta a nodos y validadores nuevos, que se reinician o que se resincronizan. Este problema se corrige en la versión 1.7.18."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "klever-io",
          "product": "klever-go",
          "versions": [
            {
              "version": "< 1.7.18",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-13T18:40:07.764602Z",
          "id": "CVE-2026-49343",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        },
        {
          "lang": "en",
          "value": "CWE-772"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/klever-io/klever-go/releases/tag/v1.7.18",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/klever-io/klever-go/security/advisories/GHSA-fw38-pc54-jvx9",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/klever-io/klever-go/security/advisories/GHSA-fw38-pc54-jvx9",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}