Klever-Go, the Go implementation of the Klever blockchain protocol, has a resource‑exhaustion vulnerability in its account‑data trie sync mechanism. During account synchronization, a throttler slot is reserved but is never released when certain errors occur, such as failures to create a trie or timeouts. Each unreleased slot permanently occupies the throttler, eventually exhausting its capacity. When the throttler is full, subsequent sync operations fail and return timeouts, causing critical bootstrap and state synchronization processes to abort. This flaw directly leads to a denial of service against nodes and validators that rely on successful bootstrap or resynchronization.

The vulnerability affects all installations of Klever‑IO’s Klever‑Go product running any version prior to 1.7.18. Updating to version 1.7.18 or later eliminates the flaw; earlier versions remain susceptible.

With a CVSS score of 5.9 the flaw is of moderate severity. The EPSS score is not available, and the vulnerability is not listed in KEV, indicating no confirmed public exploitation yet. An attacker, particularly one capable of inducing repeated trie‑sync failures or timeouts—such as a network adversary or a malicious peer—can target bootstrap operations to exhaust throttler slots. Once exhausted, state sync halts, resulting in persistent availability issues for new or resynchronizing nodes.