CVE-2026-49343

Name of the Vulnerable Software and Affected Versions Klever-Go versions prior to 9640d63

Description A resource leak exists in the account-data trie syncers where bounded throttler slots are not released during error paths in the syncDataTrie() function. When a trie sync fails, a slot from the NumGoRoutinesThrottler is permanently consumed and never returned. This occurs specifically when trie.NewTrie(), trie.NewTrieSyncer(), or trieSyncer.StartSyncing() return an error.

Because the NumGoRoutinesThrottler is a strict bounded counter, repeated failures exhaust the available capacity. This prevents further progress in account-data trie synchronization, leading to a timeout in the SyncAccounts() process and the ultimate failure of the epoch bootstrap. This issue impacts node availability for fresh or restarting nodes and validators during state synchronization.

Recommendations In data/syncer/userAccountsSyncer.go and data/syncer/kappAccountsSyncer.go, implement a defer call to EndProcessing() immediately after calling StartProcessing() within the syncDataTrie() function to ensure slots are released regardless of the execution path.