{"id":"EUVD-2026-54718","enisaUuid":"04432597-db9f-3c23-9b3a-14ad57baa6e3","description":"Klever-Go is the Go implementation of the Klever blockchain protocol. Versions 1.7.14 through 1.7.17 are vulnerable to a nil-pointer panic triggered by a protobuf Transaction whose embedded RawData sub-message is omitted. This omission causes RawData to decode to nil. Every transaction gossiped on the Klever-Go P2P network is decoded and validated synchronously inside the libp2p pubsub topic-validator callback, where txVersionChecker.CheckTxVersion dereferences tx.RawData.Version with no nil check. Because the libp2p pubsub callback, the underlying go-libp2p-pubsub validation worker, and Klever\u0027s own network/p2p layer install no recover(), the panic propagates and crashes the entire node process. The attacker payload is a 3-byte protobuf message; no validator key, stake, funds, or on-chain account is required, and delivery aimed at enough of the BLS validator set can halt block production, resulting in a chain halt. This issue has been fixed in version 1.7.18.","datePublished":"Aug 7, 2026, 10:32:27 PM","dateUpdated":"Aug 10, 2026, 2:16:48 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/klever-io/klever-go/security/advisories/GHSA-rm5c-5x2p-48wr\nhttps://github.com/klever-io/klever-go/releases/tag/v1.7.18\n","aliases":"CVE-2026-52878\nGHSA-rm5c-5x2p-48wr\n","assigner":"GitHub_M","epss":0.49,"enisaIdProduct":[{"id":"289c8370-98dc-3317-9cb7-dfa549275397","product":{"name":"klever-go","vendor":{"name":"klever-io"}},"product_version":"1.7.14, \u003c 1.7.18"}],"enisaIdVendor":[{"id":"ffba0c6c-a4db-39a7-9878-3f61bb0def88","vendor":{"name":"klever-io"}}],"enisaIdVulnerability":[{"id":"66f2da25-f61a-3fa1-aa91-b7cbacdc607a","vulnerability":{"id":"CVE-2026-52878","description":"Klever-Go is the Go implementation of the Klever blockchain protocol. Versions 1.7.14 through 1.7.17 are vulnerable to a nil-pointer panic triggered by a protobuf Transaction whose embedded RawData sub-message is omitted. This omission causes RawData to decode to nil. Every transaction gossiped on the Klever-Go P2P network is decoded and validated synchronously inside the libp2p pubsub topic-validator callback, where txVersionChecker.CheckTxVersion dereferences tx.RawData.Version with no nil check. Because the libp2p pubsub callback, the underlying go-libp2p-pubsub validation worker, and Klever\u0027s own network/p2p layer install no recover(), the panic propagates and crashes the entire node process. The attacker payload is a 3-byte protobuf message; no validator key, stake, funds, or on-chain account is required, and delivery aimed at enough of the BLS validator set can halt block production, resulting in a chain halt. This issue has been fixed in version 1.7.18.","datePublished":"Aug 7, 2026, 10:32:27 PM","dateUpdated":"Aug 10, 2026, 2:16:48 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/klever-io/klever-go/security/advisories/GHSA-rm5c-5x2p-48wr\nhttps://github.com/klever-io/klever-go/releases/tag/v1.7.18\n","enisa_id":"EUVD-2026-54718\n","assigner":"GitHub_M","epss":0.49,"dataProcessed":"Nov 1, 2026, 7:16:48 AM","vulnerabilityProduct":[{"id":"1d2e629c-1c2e-3486-9599-7fa93ae5feef","product":{"name":"klever-go","vendor":{"name":"klever-io"}},"product_version":"1.7.14, \u003c 1.7.18"}],"vulnerabilityVendor":[{"id":"a39e2541-5a3c-3464-92f1-29d552950140","vendor":{"name":"klever-io"}}]}},{"id":"aaabdb27-03a7-3f28-bfb5-30e0b3985b6d","vulnerability":{"id":"GHSA-rm5c-5x2p-48wr","description":"Klever-Go KVM: Unauthenticated remote node crash (nil-pointer DoS) in klever-go P2P transaction interceptor (txVersionChecker nil RawData) - potential chain halt","datePublished":"Jun 5, 2026, 4:42:38 PM","dateUpdated":"Jun 9, 2026, 6:40:35 PM","baseScore":0.0,"references":"https://github.com/klever-io/klever-go/security/advisories/GHSA-rm5c-5x2p-48wr\nhttps://github.com/klever-io/klever-go\nhttps://github.com/klever-io/klever-go/releases/tag/v1.7.18\n","enisa_id":"EUVD-2026-54718\n","aliases":"GHSA-rm5c-5x2p-48wr\nCVE-2026-52878\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:03 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}