CVE-2026-44697 Details
Description
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.17, a remote, unauthenticated denial-of-service vulnerability in Batch.Decompress (data/batch/batch.go) allows any peer that participates in a topic served by MultiDataInterceptor to allocate multi-gigabyte heaps on the receiving node from a sub-50 KiB gossip payload. A single packet is sufficient to OOM-kill a validator with conventional memory provisioning. Fleet-wide application affects chain liveness. This vulnerability is fixed in 1.7.17.
A remote, unauthenticated denial-of-service vulnerability has been identified in Klever-Go versions prior to 1.7.17. The issue resides in the Batch.Decompress function, where an attacker can send a sub-50 KiB gossip payload that is processed by the MultiDataInterceptor. This payload is decompressed without size validation, leading to multi-gigabyte memory allocations on the receiving node. A single packet can cause a validator to run out of memory, disrupting chain liveness. The vulnerability was discovered during an internal security review and is more severe than a previously disclosed throttler-slot-leak vulnerability.
Users are advised to upgrade to Klever-Go version 1.7.17 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 29, 2026CISA-ADP
Assessed Jun 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/klever-io/klever-go/security/advisories/GHSA-87m7-qffr-542v | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/klever-io/klever-go/security/advisories/GHSA-87m7-qffr-542v | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-409 | Improper Handling of Highly Compressed Data (Data Amplification) | [email protected] |
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Klever-Go | < 1.7.17 (semver) |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Modified | [email protected] |
| Jul 21, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 2, 2026 | CVE Modified | CISA-ADP |
| May 29, 2026 | New CVE Received | [email protected] |