GHSA-74m6-4hjp-7226

## Publisher note **Fixed in `v1.7.17`.** Operators running `< v1.7.17` should upgrade. The decompression-error path in `MultiDataInterceptor.ProcessReceivedMessage` now releases the global throttler slot before returning (guarded `defer` after `StartProcessing()`, disabled when the asynchronous goroutine takes ownership). Patch commits on `develop`: 333f6ec9, 68b94a40 (merged from private fork `klever-io/klever-go-ghsa-74m6-4hjp-7226`). This advisory was originally filed jointly with a separate KVM read-only isolation bypass; that finding is now tracked under [GHSA-jc6w-wmfc-fh33](https://github.com/klever-io/klever-go/security/advisories/GHSA-jc6w-wmfc-fh33) so each issue receives its own CVE. The original disclosure from @LoGGGG240211 follows verbatim, including the embedded proof-of-concept source. --- # Private Vulnerability Report Repository: klever-io/klever-go Reviewed commit: 405d01b0abbf0d3e73b4a990bd7394a01f200dc2 Disclosure channel: GitHub Private Vulnerability Reporting Reporter GitHub account: LoGGGG240211 ## 2.1 MultiDataInterceptor malformed compressed batches permanently consume global P2P throttler slots Severity : High Confidence : HIGH Attack Complexity : LOW PoC Status : Confirmed ### Description The P2P `MultiDataInterceptor` starts throttled processing before it validates and decompresses a received batch. `PreProcessMessage` checks whether the global interceptor throttler can process the message and then calls `StartProcessing()`. After that point, `ProcessReceivedMessage` unmarshals the batch and enters the compressed-batch branch when `b.IsCompressed` is true. If `b.Decompress()` fails, the function logs the gzip error and returns immediately without calling `EndProcessing()`. This creates a permanent slot leak in the interceptor throttler. The normal successful path releases the slot only later in the asynchronous processing goroutine. Other validation error paths release the slot explicitly, but