CVE-2026-52878 Details
Description
Klever-Go is the Go implementation of the Klever blockchain protocol. Versions 1.7.14 through 1.7.17 are vulnerable to a nil-pointer panic triggered by a protobuf Transaction whose embedded RawData sub-message is omitted. This omission causes RawData to decode to nil. Every transaction gossiped on the Klever-Go P2P network is decoded and validated synchronously inside the libp2p pubsub topic-validator callback, where txVersionChecker.CheckTxVersion dereferences tx.RawData.Version with no nil check. Because the libp2p pubsub callback, the underlying go-libp2p-pubsub validation worker, and Klever's own network/p2p layer install no recover(), the panic propagates and crashes the entire node process. The attacker payload is a 3-byte protobuf message; no validator key, stake, funds, or on-chain account is required, and delivery aimed at enough of the BLS validator set can halt block production, resulting in a chain halt. This issue has been fixed in version 1.7.18.
A denial-of-service vulnerability has been identified in Klever-Go versions 1.7.14 through 1.7.17. The issue arises from the P2P transaction interceptor, which synchronously validates transactions gossiped over the Klever-Go P2P network. When a protobuf transaction omits the embedded RawData sub-message, it decodes to nil. The validation process then dereferences the nil RawData without a check, leading to a nil-pointer panic. This panic propagates through the validation chain, crashing the node process. The vulnerability can be exploited by sending a crafted 3-byte protobuf message, causing a targeted node to crash and potentially halt block production if directed at enough validators.
Users are advised to upgrade to Klever-Go version 1.7.18, which addresses this vulnerability by adding a nil check in the transaction version validation process.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 7, 2026CISA-ADP
Assessed Aug 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/klever-io/klever-go/security/advisories/GHSA-rm5c-5x2p-48wr | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/klever-io/klever-go/releases/tag/v1.7.18 | [email protected] | Release NotesVendor |
| https://github.com/klever-io/klever-go/security/advisories/GHSA-rm5c-5x2p-48wr | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Klever-Go | >= 1.7.14, <= 1.7.17 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 10, 2026 | CVE Modified | CISA-ADP |
| Aug 7, 2026 | New CVE Received | [email protected] |