{"answers":{"affected":"3 open source packages ship an affected version, including github.com/klever-io/klever-go.","exploited":"There is no known exploitation of GHSA-74m6-4hjp-7226 in the wild and no public exploit code.","fix":"Upgrade github.com/klever-io/klever-go to 1.7.17 or later.","what":"GHSA-74m6-4hjp-7226 is a denial of service vulnerability in github.com/klever-io/klever-go, published on 4 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-74m6-4hjp-7226 and fix it if it is affected.\n\nWhat it is: GHSA-74m6-4hjp-7226 is a denial of service vulnerability in github.com/klever-io/klever-go, published on 4 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-74m6-4hjp-7226 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github.com/klever-io/klever-go (Go): affected all versions; fixed in 1.7.17\n- github.com/klever-io/klever-go (Go): affected all versions; fixed in 1.7.17\n- github.com/klever-io/klever-go (Go): affected all versions; fixed in 1.7.17\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-74m6-4hjp-7226/ (Markdown: https://insights.sbomify.com/GHSA-74m6-4hjp-7226/index.md)","id":"GHSA-74m6-4hjp-7226","markdown":"https://insights.sbomify.com/GHSA-74m6-4hjp-7226/index.md","name":"GHSA-74m6-4hjp-7226","record":{"aliases":["GO-2026-5204"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Go P2P library","requires_auth":"none","summary":"Attackers can cause permanent denial of service by sending malformed compressed batches that leak throttler slots in the Klever-Go P2P library.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"## Publisher note\n\n**Fixed in `v1.7.17`.** Operators running `\u003c v1.7.17` should upgrade. The decompression-error path in `MultiDataInterceptor.ProcessReceivedMessage` now releases the global throttler slot before returning (guarded `defer` after `StartProcessing()`, disabled when the asynchronous goroutine takes ownership).\n\nPatch commits on `develop`: 333f6ec9, 68b94a40 (merged from private fork `klever-io/klever-go-ghsa-74m6-4hjp-7226`).\n\nThis advisory was originally filed jointly with a separate KVM read-only isolation bypass; that finding is now tracked under [GHSA-jc6w-wmfc-fh33](https://github.com/klever-io/klever-go/security/advisories/GHSA-jc6w-wmfc-fh33) so each issue receives its own CVE.\n\nThe original disclosure from @LoGGGG240211 follows verbatim, including the embedded proof-of-concept source.\n\n---\n\n# Private Vulnerability Report\n\nRepository: klever-io/klever-go\nReviewed commit: 405d01b0abbf0d3e73b4a990bd7394a01f200dc2\nDisclosure channel: GitHub Private Vulnerability Reporting\nReporter GitHub account: LoGGGG240211\n\n## 2.1 MultiDataInterceptor malformed compressed batches permanently consume global P2P throttler slots\n\nSeverity            : High\nConfidence          : HIGH\nAttack Complexity   : LOW\nPoC Status          : Confirmed\n\n### Description\n\nThe P2P `MultiDataInterceptor` starts throttled processing before it validates and decompresses a received batch. `PreProcessMessage` checks whether the global interceptor throttler can process the message and then calls `StartProcessing()`. After that point, `ProcessReceivedMessage` unmarshals the batch and enters the compressed-batch branch when `b.IsCompressed` is true. If `b.Decompress()` fails, the function logs the gzip error and returns immediately without calling `EndProcessing()`.\n\nThis creates a permanent slot leak in the interceptor throttler. The normal successful path releases the slot only later in the asynchronous processing goroutine. Other validation error paths release the slot explicitly, but the decompression-error path does not. The impact is amplified because the same global throttler is shared by transaction multi-data interceptors, trie-node multi-data interceptors, and header interceptors. The hardcoded global capacity is 100, so a connected peer that can deliver 100 malformed compressed batch envelopes can cause later valid P2P interceptor processing on the affected node to fail with `system busy` until the process is restarted or the throttler state is otherwise reset.\n\n### Location\n\n1. [baseDataInterceptor.go, PreProcessMessage(), line 42](https://github.com/klever-io/klever-go/blob/405d01b0abbf0d3e73b4a990bd7394a01f200dc2/core/process/interceptors/baseDataInterceptor.go#L42)\n2. [baseDataInterceptor.go, PreProcessMessage(), line 47](https://github.com/klever-io/klever-go/blob/405d01b0abbf0d3e73b4a990bd7394a01f200dc2/core/process/interceptors/baseDataInterceptor.go#L47)\n3. [multiDataInterceptor.go, ProcessReceivedMessage(), line 95](https://github.com/klever-io/klever-go/blob/405d01b0abbf0d3e73b4a990bd7394a01f200dc2/core/process/interceptors/multiDataInterceptor.go#L95)\n4. [multiDataInterceptor.go, ProcessReceivedMessage(), line 99](https://github.com/klever-io/klever-go/blob/405d01b0abbf0d3e73b4a990bd7394a01f200dc2/core/process/interceptors/multiDataInterceptor.go#L99)\n5. [baseInterceptorsContainerFactory.go, numGoRoutines, line 21](https://github.com/klever-io/klever-go/blob/405d01b0abbf0d3e73b4a990bd7394a01f200dc2/core/process/factory/interceptorscontainer/baseInterceptorsContainerFactory.go#L21)\n6. [baseInterceptorsContainerFactory.go, createOneTxInterceptor(), line 160](https://github.com/klever-io/klever-go/blob/405d01b0abbf0d3e73b4a990bd7394a01f200dc2/core/process/factory/interceptorscontainer/baseInterceptorsContainerFactory.go#L160)\n7. [baseInterceptorsContainerFactory.go, createOneTrieNodesInterceptor(), line 190](https://github.com/klever-io/klever-go/blob/405d01b0abbf0d3e73b4a990bd7394a01f200dc2/core/process/factory/interceptorscontainer/baseInterceptorsContainerFactory.go#L190)\n8. [baseInterceptorsContainerFactory.go, generateMetachainHeaderInterceptors(), line 232](https://github.com/klever-io/klever-go/blob/405d01b0abbf0d3e73b4a990bd7394a01f200dc2/core/process/factory/interceptorscontainer/baseInterceptorsContainerFactory.go#L232)\n\n### Preconditions\n\n1. The attacker can connect as a P2P peer or otherwise send P2P messages that reach a `MultiDataInterceptor` topic handler.\n2. The malformed message must pass the outer preprocessing checks before the decompression branch.\n3. No validator role, private key, capital, oracle condition, or timing condition is required.\n\n### Impact\n\nSuccessful exploitation causes a persistent per-node denial of P2P interceptor processing until node restart or throttler reset. The affected throttler is shared across transaction batch processing and trie-node sync processing, and header processing also uses the same throttler. The PoC demonstrates the concrete effect with a capacity-2 throttler: two malformed compressed batches leak both slots and the third message returns `system busy`. In the reviewed codebase, the production factory hardcodes the shared capacity to 100, so the same condition is expected after approximately 100 malformed compressed batches. The impact is reversible by restarting the node or otherwise resetting the throttler state.\n\n### Exploit Cost\n\nNo gas and no protocol capital are required. The practical cost is the network cost of sending malformed compressed P2P batch messages to the target node, approximately 100 messages for the hardcoded production global capacity.\n\n### Steps to Reproduce\n\n1. Place `poc_mdi_throttler_slot_leak_test.go` in an empty directory.\n2. Run the dependency commands listed in the PoC header.\n3. Run `GOTOOLCHAIN=go1.25.9 go test -v poc_mdi_throttler_slot_leak_test.go`.\n4. Observe that the first proof increments `StartProcessing()` without incrementing `EndProcessing()` after a gzip decompression error.\n5. Observe that the second proof uses a real capacity-2 throttler and reaches `system busy` on the third malformed compressed batch.\n\n### Proof-of-Concept Result\n\nRunning `GOTOOLCHAIN=go1.25.9 go test -v poc_mdi_throttler_slot_leak_test.go` after dependency setup produces the following output. The result confirms that malformed compressed batches leak throttler slots and cause a real throttler to reject later processing as `system busy`.\n\n```text\n=== RUN   TestPoC_MalformedCompressedBatchLeaksThrottlerSlot\nERROR[2026-04-28 13:35:04.398]   MultiDataInterceptor.ProcessReceivedMessage err = gzip: invalid header\n    poc_mdi_throttler_slot_leak_test.go:108: process_error=gzip: invalid header\n    poc_mdi_throttler_slot_leak_test.go:109: start_count_before=0\n    poc_mdi_throttler_slot_leak_test.go:110: start_count_after=1\n    poc_mdi_throttler_slot_leak_test.go:111: end_count_before=0\n    poc_mdi_throttler_slot_leak_test.go:112: end_count_after=0\nERROR[2026-04-28 13:35:04.398]   MultiDataInterceptor.ProcessReceivedMessage err = gzip: invalid header\nERROR[2026-04-28 13:35:04.398]   MultiDataInterceptor.ProcessReceivedMessage err = gzip: invalid header\n    poc_mdi_throttler_slot_leak_test.go:133: real_throttler_attempt_1=gzip: invalid header\n    poc_mdi_throttler_slot_leak_test.go:134: real_throttler_attempt_2=gzip: invalid header\n    poc_mdi_throttler_slot_leak_test.go:135: real_throttler_attempt_3=system busy\n--- PASS: TestPoC_MalformedCompressedBatchLeaksThrottlerSlot (0.00s)\nPASS\nok  \tcommand-line-arguments\t0.002s\n```\n\n### Suggested Fix\n\nEnsure that every path after `StartProcessing()` releases the throttler slot exactly once. A direct fix is to call `EndProcessing()` before returning from the decompression-error branch. A more robust fix is to use a guarded `defer` immediately after `StartProcessing()` and disable that defer only when the asynchronous goroutine takes ownership of releasing the slot.\n\n## Closing\n\nI am available to answer technical questions regarding these findings and to","ecosystems":["Go"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Klever-Go P2P MultiDataInterceptor leaks global throttler slots on malformed compressed batches (DoS)","id":"GHSA-74m6-4hjp-7226","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"Go","product":null,"products":[],"type":"denial_of_service","year":"2026"},"n_packages":3,"n_references":null,"packages":[{"ecosystem":"Go","fixed":["1.7.17"],"introduced":["0"],"last_affected":[],"package":"github.com/klever-io/klever-go","purl":null,"source":"GHSA-74m6-4hjp-7226"},{"ecosystem":"Go","fixed":["1.7.17"],"introduced":["0"],"last_affected":[],"package":"github.com/klever-io/klever-go","purl":"pkg:golang/github.com/klever-io/klever-go","source":"GHSA-74m6-4hjp-7226"},{"ecosystem":"Go","fixed":["1.7.17"],"introduced":["0"],"last_affected":[],"package":"github.com/klever-io/klever-go","purl":"pkg:golang/github.com/klever-io/klever-go","source":"GO-2026-5204"}],"products":null,"published":"2026-06-04","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Attackers can cause permanent denial of service by sending malformed compressed batches that leak throttler slots in the Klever-Go P2P library.","url":"https://insights.sbomify.com/GHSA-74m6-4hjp-7226/"}