Klever v1.7.18 Security Release: Fixes for 5 Coordinated Disclosure Vulnerabilities (DoS/Resource Exhaustion)

Vulnerability Overview Version 1.7.18 is a coordinated security release that addresses five vulnerabilities disclosed under coordinated disclosure guidelines (four high-severity and one medium-severity), affecting the P2P interceptor/parser pipeline, REST API, and state synchronization paths. Additionally, this release includes hardening against data races and goroutine leaks, new observability metrics, and core performance improvements. Impact Scope GHSA-rm5c-5x2p-48wr: Unauthenticated nil pointer Denial of Service (DoS) in the P2P transaction interceptor (High - CWE-476). GHSA-w342-mj6g-v9c4: Hash array amplification in P2P parser request handling (High - CWE-400). GHSA-h2g-6j7h-98wg: Unlimited goroutine generation in the direct message entry point (High - CWE-400 / CWE-770). GHSA-w4c6-7r69-w7j9: REST API Slow Header/Slow Body connection exhaustion (High - CWE-400 / CWE-770). GHSA-fw38-pc54-jvx9: Leaking throttler slots in Trie account data synchronization (Medium - CWE-400 / CWE-772). Remediation 1. GHSA-rm5c-5x2p-48wr - Fixed the issue of unauthenticated nil pointers in the transaction interceptor, closing a potential chain head vector attack surface. 2. GHSA-w342-mj6g-v9c4 - Restricted the count of decoded items in , closing the amplification vulnerability in . 3. GHSA-h2g-6j7h-98wg - Synchronized handling of the direct message entry point and removed unlimited per-message goroutine generation, preventing connection-driven goroutine and memory exhaustion. 4. GHSA-w4c6-7r69-w7j9 - Hardened the to route all REST listeners, closing the Slow Header vector. - Added per-request body read deadlines and tightened header/body capacity limits, closing residual Slow Body vectors. 5. GHSA-fw38-pc54-jvx9 - Fixed bounded throttler slot leaks in , preventing issues with long-running WebSocket streams. Additional Improvements API & WebSocket - Dispatched WebSocket account events on non-indexed nodes, extending real-time event access. - Reduced log noise and exposed , , and endpoints. Monitoring & Observability - Exposed redundant metrics via and Prometheus. - Exposed NTP clock offset and last synchronization timestamp as metrics to improve time synchronization visibility. Network - Disabled on seed nodes, allowing seed nodes to serve more concurrent peers. Operational Tools - Displayed transaction hashes in pre-sign review prompts. Performance Improvements - Reduced per-transaction goroutine fan-out in , lowering scheduling overhead on the hot transaction validation path. - Implemented zero-copy and pre-sized receive filters, reducing allocations in contract result processing. Stability & Concurrency - Fixed data races in the consensus, sharding, and libp2p layers. - Added to for consistent reads. - Implemented graceful goroutine shutdown on close, eliminating goroutine leaks during shutdown. - Stopped monitor and sender goroutines during shutdown. - Made stoppable and closed it within the goroutine. - Used for sentinel comparison and hardcoded error matching. Bug Fixes - Fixed the test, utilizing slot-relative ITO windows. Infrastructure & DevOps - Reorganized packages and added pprof debugging targets. Upgrade Instructions All node operators are strongly advised to upgrade to v1.7.18 as soon as possible to benefit from the aforementioned security fixes. No configuration changes or data migration are required. Contributors @fbsobreira @phcarniero Security Researchers @chdr0ut8 @estensen @leduckhuong @maliquynhh Full Changelog v1.7.17...v1.7.18 Assets 5 assets Contributors fbsobreira, estensen, and 4 other contributors --- Code Blocks No POC code or exploitation code provided.

Goal Reached Thanks to every supporter — we hit 100%!

Klever v1.7.18 Security Release: Fixes for 5 Coordinated Disclosure Vulnerabilities (DoS/Resource Exhaustion)

More from this source