CVE-2026-52878
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
Klever-Go versions 1.7.14 through 1.7.17 are vulnerable to a nil-pointer panic triggered by a protobuf Transaction with omitted RawData sub-message. The lack of nil check before dereferencing tx.RawData.Version in txVersionChecker.CheckTxVersion causes a crash of the entire node process, potentially leading to a chain halt.
Risk Assessment
An attacker can send a small packet (3 bytes) to nodes, causing crashes and potentially halting block production across the network.
Recommendation
Upgrade to version 1.7.18, which contains the fix.
Other vulnerabilities in Klever-Go
See all- CVE-2026-54755Critical
Klever-Go before version 1.7.19 has a vulnerability in decoding split-royalty fields that can contain values greater than core.HundredPercent, and summing in uint32 accumulators can wrap the validation sum to zero and bypass checks. Royalty payout paths credit each oversized split amount and silently discard a negative remainder, allowing ordinary transfers to create unbacked KLV or other assets. This issue is fixed in version 1.7.19.
- CVE-2026-54754Critical
Klever-Go before version 1.7.19 has a vulnerability in marketplace settlement where it reads MarketOrderData.ReferralPercentage from the listing while reading asset.Royalties.MarketPercentage live at purchase time. An asset owner can create a valid listing and then use AssetTrigger UpdateRoyalties to make the combined percentages exceed the bid. executeBuyMarket pays referral and royalty amounts unconditionally while computeMarketOwnerAmount silently skips a nonpositive seller remainder, allowing more currency to be credited than paid. This issue is fixed in version 1.7.19.
- CVE-2026-55764High
Vulnerability in Klever-Go (Klever blockchain implementation) before version 1.7.19. A mint-role holder can bypass the finite MaxSupply on semi-fungible tokens via integer overflow, crediting a huge amount and corrupting the on-chain counter. Fixed in version 1.7.19.
- CVE-2026-55763High
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, processPercentageRoyaltiesTransfer in core/kapp/accounts/accounts.go calls SubFromBalance after the split loop and after the royaltiesToPay <= 0 early return. computeSplitRoyalties rejects only when splitToPay > royaltiesToPay, so a valid PercentTransferPercentage = 10000 split consumes exactly 100 percent of the royalty pool, sets royaltiesToPay to zero, and returns before the source account is debited. The split recipient receives the full royaltyAmount while the sender pays nothing and the supply counter is not updated, allowing unbounded off-the-books inflation of the transferred KDA. A KDA owner must configure a TransferPercentage royalty with a 100 percent split, after which any holder's transfer of the asset triggers the mint; the sibling processFixedRoyaltiesTransfer path is not affected because it debits the source before distribution. This issue is fixed in version 1.7.19.
- CVE-2026-52880High
Klever-Go, the Go implementation of the Klever blockchain protocol, versions 1.7.14 through 1.7.17 are vulnerable to a remotely triggerable denial of service. REST APIs are started with the default Go HTTP server without ReadHeaderTimeout, ReadTimeout, or MaxHeaderBytes configured, allowing connections to be held open indefinitely, exhausting file descriptors.
- CVE-2026-52879High
Klever-Go versions 1.7.14 through 1.7.17 are vulnerable to a remotely triggerable denial of service via unbounded goroutine creation. The direct-message ingress handler spawns a goroutine for every message before antiflood checks, allowing a single peer to send a stream of messages and overload the node.
- CVE-2026-49343Medium
Klever-Go, the Go implementation of the Klever blockchain protocol, versions prior to 1.7.18 have a resource-exhaustion flaw in account-data trie syncers. Errors on error paths permanently consume throttler slots, potentially causing sync to stop and bootstrap to fail. Fixed in version 1.7.18.
- CVE-2026-47249High
Klever-Go prior to version 1.7.18 is vulnerable to hash-array amplification in the P2P resolver request handling logic. A small compressed request (442 bytes) can expand into 200,000 decoded hash entries, causing remote memory and CPU amplification.
- CVE-2026-58262High
Klever-Go prior to version 1.7.20 has a vulnerability in header signature verification where unused padding bits of PubKeysBitmap are counted toward the two-thirds validator quorum. A malicious block producer can set these bits to reach the required quorum without genuine signatures, weakening consensus safety.
- CVE-2026-46403Medium
Vulnerability in Klever-Go (Go implementation of the Klever blockchain protocol) before version 1.7.17. Read-only mode was not enforced in contract delete and upgrade paths, allowing contracts called in read-only mode to mutate chain state.
Original NVD description (English source)
Klever-Go is the Go implementation of the Klever blockchain protocol. Versions 1.7.14 through 1.7.17 are vulnerable to a nil-pointer panic triggered by a protobuf Transaction whose embedded RawData sub-message is omitted. This omission causes RawData to decode to nil. Every transaction gossiped on the Klever-Go P2P network is decoded and validated synchronously inside the libp2p pubsub topic-validator callback, where txVersionChecker.CheckTxVersion dereferences tx.RawData.Version with no nil check. Because the libp2p pubsub callback, the underlying go-libp2p-pubsub validation worker, and Klever's own network/p2p layer install no recover(), the panic propagates and crashes the entire node process. The attacker payload is a 3-byte protobuf message; no validator key, stake, funds, or on-chain account is required, and delivery aimed at enough of the BLS validator set can halt block production, resulting in a chain halt. This issue has been fixed in version 1.7.18.