Vulnerabilidad · Publicado 07/08/2026 · Actualizado 08/08/2026
Klever-Go versiones 1.7.14 a 1.7.17 son vulnerables a un pánico por null-pointer desencadenado cuando una transacción protobuf omite el sub-mensaje RawData incrustado. Un atacante puede enviar transacciones malformadas a través de la red P2P de Klever-Go para causar caída inmediata de nodos validadores. Esto afecta principalmente a operadores de nodos blockchain, exchanges cripto y plataformas DeFi en México y LATAM que ejecuten estas versiones.
Klever-Go is the Go implementation of the Klever blockchain protocol. Versions 1.7.14 through 1.7.17 are vulnerable to a nil-pointer panic triggered by a protobuf Transaction whose embedded RawData sub-message is omitted. This omission causes RawData to decode to nil. Every transaction gossiped on the Klever-Go P2P network is decoded and validated synchronously inside the libp2p pubsub topic-validator callback, where txVersionChecker.CheckTxVersion dereferences tx.RawData.Version with no nil check. Because the libp2p pubsub callback, the underlying go-libp2p-pubsub validation worker, and Klever's own network/p2p layer install no recover(), the panic propagates and crashes the entire node process. The attacker payload is a 3-byte protobuf message; no validator key, stake, funds, or on-chain account is required, and delivery aimed at enough of the BLS validator set can halt block production, resulting in a chain halt. This issue has been fixed in version 1.7.18.
Score: 7.5/10 — Severidad: HIGH — Estado NIST: Received
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-476
Publicado en NIST NVD.