Vulnerability · Published May 29, 2026 · Assigned by GitHub_M

CVE-2026-44697Klever-Go MultiDataInterceptor: remote OOM via crafted compressed P2P payload

High 8.6

In plain English

A high-severity resource allocation without limits in klever-go from klever-io. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)8.6High

Exploit odds (30 days)0.4%top 66.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.17, a remote, unauthenticated denial-of-service vulnerability in Batch.Decompress (data/batch/batch.go) allows any peer that participates in a topic served by MultiDataInterceptor to allocate multi-gigabyte heaps on the receiving node from a sub-50 KiB gossip payload. A single packet is sufficient to OOM-kill a validator with conventional memory provisioning. Fleet-wide application affects chain liveness. This vulnerability is fixed in 1.7.17.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/klever-io/klever-go	no fix listed	GHSA-87m7-qffr-542v
Go	github.com/klever-io/klever-go	no fix listed	GO-2026-5246

Affected products (as reported)

Vendor	Product	Versions
klever-io	klever-go	< 1.7.17

Weakness: CWE-409, CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

References

https://github.com/klever-io/klever-go/security/advisories/GHSA-87m7-qffr-542v x_refsource_CONFIRM