CVE-2026-52879

This CVE exposes a structural failure in how Klever-Go (a Go blockchain node implementation) handles peer message processing. The antiflood logic was implemented inside the message handler goroutine rather than as a gate that governs whether a goroutine can be created at all. The difference matters: a control that runs inside the execution path it should be limiting cannot prevent unbounded resource creation because the resource creation is the very thing that triggers it. The fix in version 1.7.18 reordered the spawn logic to place admission checks before goroutine creation. But verifying that this fix is complete requires more than diff inspection. The critical question is whether every code path into goroutine creation passes through the antiflood check atomically—including network callbacks, timer callbacks, and interface method dispatches that may spawn goroutines below the application-level admission gate. If even one async boundary exists between message arrival and goroutine spawn, the unbounded growth vulnerability persists, just one layer deeper. For defenders: treat goroutine creation bounds as a runtime-enforced property, not a code-level property you can verify statically. Instrument goroutine count as a first-class security signal—if you cannot see goroutine growth in your dashboards, you cannot distinguish 'bounded by design' from 'bounded by luck.' Complement code-level admission checks with systemic defenses: cgroup-based process limits, OS-level process isolation, or Go runtime-configurable limits. These are your backstop when the next async boundary gets added without going through your antiflood gate. The blast radius of this vulnerability class extends beyond the direct message handler. Goroutine flood starves the Go scheduler globally—degrading block propagation, consensus participation, RPC serving, and mempool management for all peers. A node that survives the flood may remain in a degraded state with heap fragmentation and elevated GC pressure, creating persistent vulnerability to follow-on exploitation.

Reviewed through automated stages and approved by a human before publication.