CVE-2026-49343 Klever-Go KVM: Throttler slot leak in trie account-data sync causes epoch bootstrap / state sync DoS
Attackers can exhaust throttler slots via sync errors, causing denial of service during node bootstrap or state synchronization in Klever-Go.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-49343?
CVE-2026-49343 is a medium-severity denial of service vulnerability in klever-io klever-go, published on 7 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Klever-Go is the Go implementation of the Klever blockchain protocol. In versions prior to 1.7.18, the account-data trie syncers are vulnerable to a resource-exhaustion flaw that leaks bounded throttler slots on error paths. In syncDataTrie() (in both userAccountsSyncer.go and kappAccountsSyncer.go), StartProcessing() reserves a slot from the NumGoRoutinesThrottler, but the corresponding EndProcessing() is only called on the success path and on the duplicate-root early return. As a result, any error from trie.NewTrie(), trie.NewTrieSyncer(), or trieSyncer.StartSyncing() (including the network-dependent timeout path) permanently consumes one slot for the lifetime of the throttler. An attacker who can repeatedly cause trie-node sync failures or timeouts during bootstrap can exhaust the bounded throttler, after which further account-data trie syncs stop making progress and SyncAccounts() returns a timeout. Because epoch bootstrap in syncUserAccountsState() and syncKappAccountsState() aborts on any such error, this causes bootstrap to fail, a core availability issue affecting fresh, restarting, or resyncing nodes and validators. This issue is fixed in version 1.7.18.
Which versions are affected by CVE-2026-49343?
3 open source packages ship an affected version, including github.com/klever-io/klever-go.
| Package | Affected | Fixed in |
|---|---|---|
github.com/klever-io/klever-go Go | All versions | 1.7.18 |
github.com/klever-io/klever-go Go | All versions | 1.7.18 |
github.com/klever-io/klever-go Go | All versions | 1.7.18 |
How do I fix CVE-2026-49343?
Upgrade github.com/klever-io/klever-go to 1.7.18 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-49343 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-49343 exists.
Sources
Also known as GHSA-fw38-pc54-jvx9, GO-2026-5379.