CyberRota Analysis
AI-GeneratedVersions 1.7.14 to 1.7.17 of the Klever-Go blockchain protocol are vulnerable to a nil-pointer panic caused by a malformed protobuf Transaction, which can lead to a crash of the entire node process. This vulnerability allows an attacker to disrupt block production by sending a minimal payload to the network, making it critical for all operators of affected nodes to upgrade to version 1.7.18 immediately to mitigate the risk of service disruption. Organizations relying on Klever-Go for blockchain operations should prioritize this update to maintain network stability and security.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Klever-Go is the Go implementation of the Klever blockchain protocol. Versions 1.7.14 through 1.7.17 are vulnerable to a nil-pointer panic triggered by a protobuf Transaction whose embedded RawData sub-message is omitted. This omission causes RawData to decode to nil. Every transaction gossiped on the Klever-Go P2P network is decoded and validated synchronously inside the libp2p pubsub topic-validator callback, where txVersionChecker.CheckTxVersion dereferences tx.RawData.Version with no nil check. Because the libp2p pubsub callback, the underlying go-libp2p-pubsub validation worker, and Klever's own network/p2p layer install no recover(), the panic propagates and crashes the entire node process. The attacker payload is a 3-byte protobuf message; no validator key, stake, funds, or on-chain account is required, and delivery aimed at enough of the BLS validator set can halt block production, resulting in a chain halt. This issue has been fixed in version 1.7.18.