Skip to contentKlever-io Klever-go vulnerabilities
- klever-io klever-goKlever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated callerCVE-2026-82405Fix available8.7 High
- klever-io klever-goKlever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgeryCVE-2026-82409Fix available8.4 High
- klever-io klever-goKlever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoSCVE-2026-82407Fix available7.0 High
- klever-io klever-goKlever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS)CVE-2026-86065Fix available7.5 High
- klever-io klever-goKlever-Go: /log controls global node loggingCVE-2026-86064Fix available8.6 High
- klever-io klever-goKlever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplaceCVE-2026-82406Fix available7.1 High
- klever-io klever-goKlever-Go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupplyCVE-2026-55764Fix available8.7 High
- klever-io klever-goKlever-Go: Percentage-transfer royalty skips the source debit at exactly-100% splitsCVE-2026-55763Fix available8.7 High
- klever-io klever-goKlever-Go: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token)CVE-2026-54755Fix available9.6 Critical
- klever-io klever-goKlever-Go: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped)CVE-2026-54754Fix available9.6 Critical
- klever-io klever-goKlever-Go: PubKeysBitmap padding bits bypass the BLS signature quorumCVE-2026-582627.1 High
- klever-io klever-goKlever-Go: Unauthenticated nil-pointer DoS in P2P transaction validation can halt the chainCVE-2026-52878Fix available7.5 High
- klever-io klever-goKlever-Go: REST API slow-header connection exhaustion via Gin Engine.RunCVE-2026-52880Fix available7.5 High
- klever-io klever-goKlever-Go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoSCVE-2026-52879Fix available7.5 High
- klever-io klever-goKlever-Go KVM: Throttler slot leak in trie account-data sync causes epoch bootstrap / state sync DoSCVE-2026-49343Fix available5.9 Medium
- klever-io klever-goKlever-Go KVM: Hash-array amplification in P2P resolver request handlingCVE-2026-47249Fix available7.5 High
- klever-io klever-goKlever-Go KVM read-only execution can commit contract delete and upgrade side effectsCVE-2026-46403Fix available6.3 Medium
- klever-io klever-goKlever-Go MultiDataInterceptor: remote OOM via crafted compressed P2P payloadCVE-2026-446978.6 High