{"id":"EUVD-2026-54718","revision":"85b74bb04185468aac2e09dedaa4ec1f","records":[{"revision":"85b74bb04185468aac2e09dedaa4ec1f","observedAt":"2026-11-01T09:15:01.084+00:00","statement":{"source":"euvd","id":"EUVD-2026-54718","aliases":["CVE-2026-52878","GHSA-rm5c-5x2p-48wr"],"title":"Klever-Go is the Go implementation of the Klever blockchain protocol. Versions 1.7.14 through 1.7.17 are vulnerable to a nil-pointer panic triggered by a protobuf Transaction whose embedded RawData sub-message is omitted. This omission caus…","description":"Klever-Go is the Go implementation of the Klever blockchain protocol. Versions 1.7.14 through 1.7.17 are vulnerable to a nil-pointer panic triggered by a protobuf Transaction whose embedded RawData sub-message is omitted. This omission causes RawData to decode to nil. Every transaction gossiped on the Klever-Go P2P network is decoded and validated synchronously inside the libp2p pubsub topic-validator callback, where txVersionChecker.CheckTxVersion dereferences tx.RawData.Version with no nil check. Because the libp2p pubsub callback, the underlying go-libp2p-pubsub validation worker, and Klever's own network/p2p layer install no recover(), the panic propagates and crashes the entire node process. The attacker payload is a 3-byte protobuf message; no validator key, stake, funds, or on-chain account is required, and delivery aimed at enough of the BLS validator set can halt block production, resulting in a chain halt. This issue has been fixed in version 1.7.18.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":null}],"references":["https://github.com/klever-io/klever-go/security/advisories/GHSA-rm5c-5x2p-48wr","https://github.com/klever-io/klever-go/releases/tag/v1.7.18"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-54718","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 7, 2026, 10:32:27 PM","dateUpdated":"Aug 10, 2026, 2:16:48 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-54718","identifiers":["EUVD-2026-54718","CVE-2026-52878","GHSA-rm5c-5x2p-48wr"]},"retained":false,"historicalAffected":[]}],"coverage":[]}