CVE-2026-52879

Name of the Vulnerable Software and Affected Versions klever-go versions prior to 1.7.18

Description An issue exists in the directMessageHandler function within the network/p2p/libp2p/netMessenger.go file. The software spawns a new goroutine for every incoming direct message before the antiflood layer can make an admission decision. Because there is no semaphore, throttler, or bound on concurrent in-flight spawns, a single connected peer can send a high volume of well-formed TopicMessage envelopes with varying sequence numbers to bypass deduplication. This leads to unbounded goroutine growth, increasing memory allocation for stacks and putting pressure on the scheduler and garbage collector, which can degrade node availability and result in a Denial of Service (DoS).

Recommendations Implement a throttler, such as goRoutinesThrottler.CanProcess(), before the goroutine spawn in the directMessageHandler function. Alternatively, remove the goroutine spawn and call the ProcessReceivedMessage() function synchronously to align with the pubsub callback path.