Read the docs
TI-2026-37977 Aliases CVE-2026-52878GHSA-rm5c-5x2p-48wr

Klever-Go: Unauthenticated nil-pointer DoS in P2P transaction validation can halt the chain

Priority HIGH 72CWE-476Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-476.

Summary

Klever-Go is the Go implementation of the Klever blockchain protocol. Versions 1.7.14 through 1.7.17 are vulnerable to a nil-pointer panic triggered by a protobuf Transaction whose embedded RawData sub-message is omitted. This omission causes RawData to decode to nil. Every transaction gossiped on the Klever-Go P2P network is decoded and validated synchronously inside the libp2p pubsub topic-validator callback, where txVersionChecker.CheckTxVersion dereferences tx.RawData.Version with no nil check. Because the libp2p pubsub callback, the underlying go-libp2p-pubsub validation worker, and Klever's own network/p2p layer install no recover(), the panic propagates and crashes the entire node process. The attacker payload is a 3-byte protobuf message; no validator key, stake, funds, or on-chain account is required, and delivery aimed at enough of the BLS validator set can halt block production, resulting in a chain halt. This issue has been fixed in version 1.7.18.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00488 42nd percentileScored 2026-11-07
Fix Fixed klever-go (klever-io): 1.7.18github.com/klever-io/klever-go (Go): 1.7.18

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
klever-ioklever-go1.7.14 to before 1.7.181.7.18Patch availableCNA
—github.com/klever-io/klever-go (Go)1.7.14 to before 1.7.181.7.18Patch availableGHSA-rm5c-5x2p-48wr
  • klever-go Vendorklever-io Affected 1.7.14 to before 1.7.18 Fixed in 1.7.18 Patch available CNA
  • github.com/klever-io/klever-go (Go) Vendor— Affected 1.7.14 to before 1.7.18 Fixed in 1.7.18 Patch available GHSA-rm5c-5x2p-48wr

Remediation

  • Fix · CNA klever-go (klever-io) Fixed in 1.7.18
  • Fix · GHSA-rm5c-5x2p-48wr github.com/klever-io/klever-go (Go) Fixed in 1.7.18 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-52878
  2. 2026-10-03 Alias added: GHSA-rm5c-5x2p-48wr

References

Other 3

  • TI-2026-40253 Klever-Go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply CVSS 4.0HIGH 8.7
  • TI-2026-40252 Klever-Go: Percentage-transfer royalty skips the source debit at exactly-100% splits CVSS 4.0HIGH 8.7
  • TI-2026-58874 Klever-Go: /log controls global node logging CVSS 3.1HIGH 8.6
  • TI-2026-32588 Klever-Go MultiDataInterceptor: remote OOM via crafted compressed P2P payload CVSS 3.1HIGH 8.6
  • TI-2026-39560 Integer underflow in klever-io klever-go CVSS 3.1CRITICAL 9.6
  • TI-2026-58875 Resource allocation without limits in klever-io klever-go CVSS 3.1HIGH 7.5
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences