CVE-2026-47249 klever-io CVE debrief

Who should care

Defenders responsible for Klever-Go implementations, particularly those using P2P connections, should assess exposure and prioritize patching to prevent potential DoS attacks. This includes operators managing affected systems, platform administrators, vulnerability management teams, and security teams that need to verify patch versions and monitor for suspicious activity.

Why it matters

CVE-2026-47249 is a high-severity vulnerability in Klever-Go that can cause remote memory and CPU amplification, potentially leading to DoS attacks. Defenders should prioritize patching vulnerable systems, verifying the patch version, and monitoring for suspicious P2P activity.

• Remote memory amplification against nodes accepting P2P peer connections
• Remote CPU amplification against nodes accepting P2P peer connections
• Potential denial-of-service (DoS) attacks
• Verification of patch version and configuration

Technical summary

The P2P resolver request handling logic in Klever-Go is vulnerable to hash-array amplification. A connected peer can send a compressed request that expands into 200,000 decoded hash entries, causing remote memory and CPU amplification. The resolver's antiflood logic counts only a single logical message and the compressed wire size, but Batch.Decompress() caps the decompressed byte size without limiting the number of decoded repeated-field items.

Defensive priority

Defenders should prioritize patching vulnerable systems, verifying the patch version, and monitoring for suspicious P2P activity.

Recommended defensive actions

• Patch vulnerable systems to version 1.7.18 or later
• Verify patch version and configuration
• Monitor P2P activity for suspicious requests
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fixed version. However, the corpus does not establish versions, exploitation, impact, or remediation beyond the provided information, requiring verification from official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.