Klever-io vulnerabilities

Products

• Klever-go 18

Newest

• klever-io klever-go Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated caller CVE-2026-82405 Fix available 8.7 HighSeptember 23, 2026
• klever-io klever-go Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery CVE-2026-82409 Fix available 8.4 HighSeptember 23, 2026
• klever-io klever-go Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS CVE-2026-82407 Fix available 7.0 HighSeptember 23, 2026
• klever-io klever-go Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS) CVE-2026-86065 Fix available 7.5 HighSeptember 23, 2026
• klever-io klever-go Klever-Go: /log controls global node logging CVE-2026-86064 Fix available 8.6 HighSeptember 23, 2026
• klever-io klever-go Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace CVE-2026-82406 Fix available 7.1 HighSeptember 23, 2026
• klever-io klever-go Klever-Go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply CVE-2026-55764 Fix available 8.7 HighAugust 28, 2026
• klever-io klever-go Klever-Go: Percentage-transfer royalty skips the source debit at exactly-100% splits CVE-2026-55763 Fix available 8.7 HighAugust 28, 2026
• klever-io klever-go Klever-Go: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token) CVE-2026-54755 Fix available 9.6 CriticalAugust 28, 2026
• klever-io klever-go Klever-Go: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped) CVE-2026-54754 Fix available 9.6 CriticalAugust 28, 2026
• klever-io klever-go Klever-Go: PubKeysBitmap padding bits bypass the BLS signature quorum CVE-2026-58262 7.1 HighAugust 7, 2026
• klever-io klever-go Klever-Go: Unauthenticated nil-pointer DoS in P2P transaction validation can halt the chain CVE-2026-52878 Fix available 7.5 HighJune 5, 2026
• klever-io klever-go Klever-Go: REST API slow-header connection exhaustion via Gin Engine.Run CVE-2026-52880 Fix available 7.5 HighJune 5, 2026
• klever-io klever-go Klever-Go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoS CVE-2026-52879 Fix available 7.5 HighJune 5, 2026
• klever-io klever-go Klever-Go KVM: Throttler slot leak in trie account-data sync causes epoch bootstrap / state sync DoS CVE-2026-49343 Fix available 5.9 MediumJune 5, 2026
• klever-io klever-go Klever-Go KVM: Hash-array amplification in P2P resolver request handling CVE-2026-47249 Fix available 7.5 HighJune 5, 2026
• klever-io klever-go Klever-Go KVM read-only execution can commit contract delete and upgrade side effects CVE-2026-46403 Fix available 6.3 MediumMay 21, 2026
• klever-io klever-go Klever-Go MultiDataInterceptor: remote OOM via crafted compressed P2P payload CVE-2026-44697 8.6 HighMay 13, 2026