Advisory Database
  • Advisories
  • Dependency Scanning
  1. golang
  2. ›
  3. github.com/klever-io/klever-go
  4. ›
  5. CVE-2026-49343

CVE-2026-49343: Klever-Go KVM: Throttler slot leak in trie account-data sync causes epoch bootstrap / state sync DoS

June 5, 2026

The account-data trie syncers leak bounded throttler slots on error paths in syncDataTrie(). Each failed trie sync permanently consumes one slot from the NumGoRoutinesThrottler, and the slot is never returned unless the sync succeeds or the root hash was already present.

I confirmed this on the current default branch develop at commit 9640d63 (observed on May 20, 2026). I also confirmed the bug with a runtime PoC using the real timeout path in trieSyncer.StartSyncing(): two timed-out sync attempts are enough to exhaust a throttler with capacity 2.

This affects the epoch bootstrap path because syncUserAccountsState() and syncKappAccountsState() create bounded throttlers and abort bootstrap immediately if the syncer returns an error. Once enough trie-root sync attempts fail, the syncer cannot make forward progress and bootstrap fails.

References

  • github.com/advisories/GHSA-fw38-pc54-jvx9
  • github.com/klever-io/klever-go/releases/tag/v1.7.18
  • github.com/klever-io/klever-go/security/advisories/GHSA-fw38-pc54-jvx9
  • nvd.nist.gov/vuln/detail/CVE-2026-49343

Code Behaviors & Features

Detect and mitigate CVE-2026-49343 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 1.7.18

Fixed versions

  • 1.7.18

Solution

Upgrade to version 1.7.18 or above.

Impact 5.9 MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Learn more about CVSS

Weakness

  • CWE-400: Uncontrolled Resource Consumption
  • CWE-772: Missing Release of Resource after Effective Lifetime

Source file

go/github.com/klever-io/klever-go/CVE-2026-49343.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Tue, 23 Jun 2026 12:22:36 +0000.