The flaw in Klever-Go allows a connected peer to send a stream of well‑formed direct messages that causes the node to spawn a new goroutine for each message before any antiflood checks are applied. Each goroutine allocates its own stack and retains a reference to the message until processing finishes, creating unbounded resource consumption and increasing scheduler and garbage‑collection pressure. The result is a remotely triggerable denial of service that degrades the node’s availability and its ability to process legitimate traffic.

Klever‑IO’s Klever-Go blockchain implementation is affected for all releases from 1.7.14 through 1.7.17. The vulnerability is fixed in version 1.7.18; no other vendors or products are impacted.

The CVSS score of 7.5 indicates a high severity risk, and although an EPSS score is not available, the flaw is not listed in CISA’s KEV catalog. A single connected peer can, by opening a direct‑send stream, flood the node with messages and trigger unbounded goroutine creation. The lack of throttling or a semaphore means the attack does not require special privileges, making the vector likely to be any external peer that can reach the node’s ingress interface.