Read the docs
TI-2026-32588 Aliases CVE-2026-44697GHSA-87m7-qffr-542v

Klever-Go MultiDataInterceptor: remote OOM via crafted compressed P2P payload

Priority HIGH 76CWE-409Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.

Summary

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.17, a remote, unauthenticated denial-of-service vulnerability in Batch.Decompress (data/batch/batch.go) allows any peer that participates in a topic served by MultiDataInterceptor to allocate multi-gigabyte heaps on the receiving node from a sub-50 KiB gossip payload. A single packet is sufficient to OOM-kill a validator with conventional memory provisioning. Fleet-wide application affects chain liveness. This vulnerability is fixed in 1.7.17.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00396 34th percentileScored 2026-11-07
Fix Fixed klever-go (klever-io): 1.7.17

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
klever-ioklever-gobefore 1.7.171.7.17Patch availableCNA
—github.com/klever-io/klever-go (Go)up to 1.7.16—No fix listedGHSA-87m7-qffr-542v
  • klever-go Vendorklever-io Affected before 1.7.17 Fixed in 1.7.17 Patch available CNA
  • github.com/klever-io/klever-go (Go) Vendor— Affected up to 1.7.16 Fixed in — No fix listed GHSA-87m7-qffr-542v

Remediation

  • Fix · CNA klever-go (klever-io) Fixed in 1.7.17

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44697
  2. 2026-10-03 Alias added: GHSA-87m7-qffr-542v

References

Advisory 1

Other 2

  • TI-2026-40253 Klever-Go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply CVSS 4.0HIGH 8.7
  • TI-2026-40252 Klever-Go: Percentage-transfer royalty skips the source debit at exactly-100% splits CVSS 4.0HIGH 8.7
  • TI-2026-58874 Klever-Go: /log controls global node logging CVSS 3.1HIGH 8.6
  • TI-2026-39560 Integer underflow in klever-io klever-go CVSS 3.1CRITICAL 9.6
  • TI-2026-58875 Resource allocation without limits in klever-io klever-go CVSS 3.1HIGH 7.5
  • TI-2026-37979 Klever-Go: REST API slow-header connection exhaustion via Gin Engine.Run CVSS 3.1HIGH 7.5
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences