klevr-go Unbounded Goroutine Spawn in DirectMessage Handler Causes DoS

Vulnerability Overview Vulnerability Name: klevr-go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoS Vulnerability Description: in spawns a new goroutine for each incoming direct message. There are no semaphores, throttlers, or limits on concurrent in-flight requests before admission decisions are made at the firewall layer. A single connected libp2p client can open a stream and send well-formed s with varying sequence numbers. The handler runs for each accepted direct message reaching , triggering a goroutine creation prior to processing. This allows unbounded goroutine growth and degradation of node availability from a single peer. The issue persists in the latest version v1.7.17, where still generates before the handler. Verified in the current commit , where the same spawn exists at . This differs from and , which address decompression/throttling behaviors related to . This report concerns the spawning of unbounded goroutines by the libp2p direct-message ingress wrapper before processor-level firewall/admission logic runs. Patches to or do not constrain this direct message goroutine spawn. Impact Scope Affected Versions: >= 1.7.14, <= 1.7.17 Fixed Version: v1.7.18 Severity: High (7.5 / 10) CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality: None - Integrity: None - Availability: High Remediation 1. Use or a dedicated ingress throttler before spawning in . 2. Remove goroutine spawning and call synchronously, aligning with the existing path. POC Code Capture Output Observations 1. 500 direct messages with a slow processor resulted in exactly 500 new goroutines. 2. The synchronous control path resulted in zero goroutine growth. 3. 2000 messages, double the egress capacity, returned immediately, indicating no ingress throttler blocked this path. Impact A single connected client can sustain unbounded goroutine spawn growth on a klevr-go node. Each spawned goroutine allocates its own stack, holds a message reference until the handler returns, and adds scheduler and GC pressure until firewall admission can reject the message. Under real-world attacker line rates and non-trivial handler latency, goroutine counts can grow faster than runtime, reducing the node's ability to process legitimate traffic. This maps to the Critical severity category in : "Denial of Service affecting network availability." Recommended Remediation 1. Use or a dedicated ingress throttler before spawning in . 2. Remove goroutine spawning and call synchronously, aligning with the existing path. Disclosure Notes This report was initially submitted to on 2025-05-12. Since lists GitHub Private Vulnerability Reporting as the recommended channel, it is being resubmitted here.

Goal Reached Thanks to every supporter — we hit 100%!

klevr-go Unbounded Goroutine Spawn in DirectMessage Handler Causes DoS

More from this source