GHSA-W342-MJ6G-V9C4高危已审查

Klever-Go KVM: Hash-array amplification in P2P resolver request handling

OSV 1.4.0 · github-reviewed · 修改于 2026-06-05 23:27

发布时间

2026-06-05 23:27

GitHub 审查时间

2026-06-05 23:27

NVD 发布时间

—

源文件

advisories/github-reviewed/2026/06/GHSA-w342-mj6g-v9c4/GHSA-w342-mj6g-v9c4.json

公告说明

Summary

A connected peer can send a compressed RequestDataType_HashArrayType direct request that is only 442 bytes on the wire but expands into 200000 decoded hash entries inside the resolver path. On klever-go v1.7.17, this allows remote memory and CPU amplification against nodes that accept P2P peer connections.

Details

Resolver antiflood logic accounts only one logical message and the compressed wire size in data/retriever/resolvers/messageProcessor.go#L30.

Batch.Decompress() in data/batch/batch.go#L122 enforces an inflated byte cap but does not enforce a decoded repeated-field item cap. After decompression, TxResolver preallocates and iterates all decoded hashes in data/retriever/resolvers/transactionResolver.go#L194, and TrieNodeResolver iterates the same unchecked decoded set in data/retriever/resolvers/trieNodeResolver.go#L108.

Pinned references:

标识信息

别名 / CVE

CVE-2026-47249

CWE

CWE-400

软件生态

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

原始 OSV JSON

{
  "id": "GHSA-w342-mj6g-v9c4",
  "aliases": [
    "CVE-2026-47249"
  ],
  "details": "### Summary\nA connected peer can send a compressed `RequestDataType_HashArrayType` direct request that is only `442` bytes on the wire but expands into `200000` decoded hash entries inside the resolver path. On `klever-go` `v1.7.17`, this allows remote memory and CPU amplification against nodes that accept P2P peer connections.\n\n### Details\nResolver antiflood logic accounts only one logical message and the compressed wire size in `data/retriever/resolvers/messageProcessor.go#L30`.\n\n`Batch.Decompress()` in `data/batch/batch.go#L122` enforces an inflated byte cap but does not enforce a decoded repeated-field item cap. After decompression, `TxResolver` preallocates and iterates all decoded hashes in `data/retriever/resolvers/transactionResolver.go#L194`, and `TrieNodeResolver` iterates the same unchecked decoded set in `data/retriever/resolvers/trieNodeResolver.go#L108`.\n\nPinned references:\n- https://github.com/klever-io/klever-go/blob/333f6ec910906e227705fc5767dc897d8fbfc862/data/retriever/resolvers/messageProcessor.go#L30\n- https://github.com/klever-io/klever-go/blob/333f6ec910906e227705fc5767dc897d8fbfc862/data/batch/batch.go#L122\n- https://github.com/klever-io/klever-go/blob/333f6ec910906e227705fc5767dc897d8fbfc862/data/retriever/resolvers/transactionResolver.go#L194\n- https://github.com/klever-io/klever-go/blob/333f6ec910906e227705fc5767dc897d8fbfc862/data/retriever/resolvers/trieNodeResolver.go#L108\n\nThis appears distinct from the public `CVE-2026-44697` / `GHSA-87m7-qffr-542v`, which covered `MultiDataInterceptor` compressed batch fan-in. This report concerns resolver request paths that remain reachable through real libp2p direct-send plumbing on `v1.7.17`.\n\n### PoC\nReproduced with:\n\n```bash\ngo run auditpoc/request_batch_hash_amplification_poc.go\ngo test github.com/klever-io/klever-go/auditpoc -run TestRequestBatchHashAmplification_DirectSendReachability -count=1\n```\n\nObserved output:\n\n```text\nrequest wire bytes: 442\nfits direct-send limit (983040 bytes): true\ntx resolver lookups: 200000\ntrie resolver lookups: 200000\nheap delta before first tx lookup: 17.47 MiB\nok   github.com/klever-io/klever-go/auditpoc\n```\n\nThe E2E harness registers the victim resolver on the request topic and sends the malicious payload through `SendToConnectedPeer()` to prove the work amplification survives the real direct-send path.\n\n### Impact\nA connected peer can convert a sub-kilobyte request into large decode-time memory pressure and synchronous CPU work on the target node. Repeated requests or several concurrent peers can degrade or exhaust validator resources, affecting node availability.",
  "summary": "Klever-Go KVM: Hash-array amplification in P2P resolver request handling",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.7.18"
            }
          ]
        }
      ],
      "package": {
        "name": "github.com/klever-io/klever-go",
        "ecosystem": "Go"
      }
    }
  ],
  "modified": "2026-06-05T15:27:42Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
    }
  ],
  "published": "2026-06-05T15:27:42Z",
  "references": [
    {
      "url": "https://github.com/klever-io/klever-go/security/advisories/GHSA-w342-mj6g-v9c4",
      "type": "WEB"
    },
    {
      "url": "https://github.com/klever-io/klever-go",
      "type": "PACKAGE"
    },
    {
      "url": "https://github.com/klever-io/klever-go/releases/tag/v1.7.18",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "nvd_published_at": null,
    "github_reviewed_at": "2026-06-05T15:27:42Z"
  }
}