CVE-2026-49343 Klever-Go KVM: Throttler slot leak in trie account-data sync causes epoch bootstrap / state sync DoS

Klever-Go is the Go implementation of the Klever blockchain protocol. In versions prior to 1.7.18, the account-data trie syncers are vulnerable to a resource-exhaustion flaw that leaks bounded throttler slots on error paths. In syncDataTrie in both userAccountsSyncer.go and kappAccountsSyncer.go,...

Klever-Go KVM: Throttler slot leak in trie account-data sync causes epoch bootstrap / state sync DoS

Summary The account-data trie syncers leak bounded throttler slots on error paths in syncDataTrie. Each failed trie sync permanently consumes one slot from the NumGoRoutinesThrottler, and the slot is never returned unless the sync succeeds or the root hash was already present. I confirmed this on...

PT-2026-47094

Name of the Vulnerable Software and Affected Versions Klever-Go versions prior to 9640d63 Description A resource leak exists in the account-data trie syncers where bounded throttler slots are not released during error paths in the syncDataTrie function. When a trie sync fails, a slot from the...