CVE-2026-52878 Klever-Go: Unauthenticated nil-pointer DoS in P2P transaction validation can halt the chain
An unauthenticated attacker can crash Klever-Go nodes and halt the blockchain by sending a malformed P2P transaction that triggers a nil-pointer panic.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-52878?
CVE-2026-52878 is a high-severity vulnerability in klever-io klever-go, published on 7 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Klever-Go is the Go implementation of the Klever blockchain protocol. Versions 1.7.14 through 1.7.17 are vulnerable to a nil-pointer panic triggered by a protobuf Transaction whose embedded RawData sub-message is omitted. This omission causes RawData to decode to nil. Every transaction gossiped on the Klever-Go P2P network is decoded and validated synchronously inside the libp2p pubsub topic-validator callback, where txVersionChecker.CheckTxVersion dereferences tx.RawData.Version with no nil check. Because the libp2p pubsub callback, the underlying go-libp2p-pubsub validation worker, and Klever's own network/p2p layer install no recover(), the panic propagates and crashes the entire node process. The attacker payload is a 3-byte protobuf message; no validator key, stake, funds, or on-chain account is required, and delivery aimed at enough of the BLS validator set can halt block production, resulting in a chain halt. This issue has been fixed in version 1.7.18.
Weakness: CWE-476
Which versions are affected by CVE-2026-52878?
3 open source packages ship an affected version, including github.com/klever-io/klever-go.
| Package | Affected | Fixed in |
|---|---|---|
github.com/klever-io/klever-go Go | From 1.7.14 | 1.7.18 |
github.com/klever-io/klever-go Go | From 1.7.14 | 1.7.18 |
github.com/klever-io/klever-go Go | From 1.7.14 | 1.7.18 |
How do I fix CVE-2026-52878?
Upgrade github.com/klever-io/klever-go to 1.7.18 or later.
Is CVE-2026-52878 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-52878 exists.
Sources
Also known as GHSA-rm5c-5x2p-48wr, GO-2026-5628.