CVE-2026-49343 Klever-Go KVM: Throttler slot leak in trie account-data sync causes epoch bootstrap / state sync DoS

Klever-Go is the Go implementation of the Klever blockchain protocol. In versions prior to 1.7.18, the account-data trie syncers are vulnerable to a resource-exhaustion flaw that leaks bounded throttler slots on error paths. In syncDataTrie in both userAccountsSyncer.go and kappAccountsSyncer.go,...

PT-2026-47094

Name of the Vulnerable Software and Affected Versions Klever-Go versions prior to 9640d63 Description A resource leak exists in the account-data trie syncers where bounded throttler slots are not released during error paths in the syncDataTrie function. When a trie sync fails, a slot from the...

PT-2026-49153

Publisher note Fixed in v1.7.17. Operators running v1.7.17 should upgrade. The decompression-error path in MultiDataInterceptor.ProcessReceivedMessage now releases the global throttler slot before returning guarded defer after StartProcessing, disabled when the asynchronous goroutine takes...