Klever-Go, the Go implementation of the Klever blockchain protocol, contains a hash-array amplification flaw in its peer‑to‑peer resolver request handling. A connected peer can send a compressed RequestDataType_HashArrayType request that is only 442 bytes on the wire but expands to more than 200,000 decoded hash entries once processed. The resolver’s antiflood logic counts only a single logical message and measures only the compressed wire size; it does not limit the number of decoded repeated‑field items. Consequently, both TxResolver and TrieNodeResolver preallocate and iterate over the entire unchecked set of decoded hashes, causing remote memory and CPU amplification against any node that accepts P2P connections.

All versions of Klever‑Go prior to 1.7.18 are affected. The product is provided by klever‑io and is deployed in blockchain networks that accept peer‑to‑peer connections.

The vulnerability has a CVSS score of 7.5 and is not listed in the CISA KEV catalog; EPSS data is unavailable. The likely attack vector is a malicious peer that establishes a P2P connection and transmits a specially crafted compressed request. An attacker could trigger significant memory and CPU usage on a victim node, potentially leading to service degradation or denial of service.