CVE-2026-44697 Overview
CVE-2026-44697 is a remote, unauthenticated denial-of-service vulnerability in Klever-Go, the Go implementation of the Klever blockchain protocol. The flaw resides in the Batch.Decompress function within data/batch/batch.go. Any peer participating in a topic served by MultiDataInterceptor can force the receiving node to allocate multi-gigabyte heaps from a gossip payload smaller than 50 KiB. A single crafted packet is sufficient to trigger an out-of-memory (OOM) kill on a validator with conventional memory provisioning. Fleet-wide exploitation directly impacts chain liveness. The issue is tracked under [CWE-409] (Improper Handling of Highly Compressed Data) and is fixed in version 1.7.17.
Critical Impact
A sub-50 KiB gossip message can OOM-kill validators across the network, halting consensus and breaking chain liveness.
Affected Products
- Klever-Go versions prior to 1.7.17
- Klever blockchain validator nodes participating in MultiDataInterceptor topics
- Peer-to-peer nodes processing gossip traffic via the Klever-Go batch interceptor
Discovery Timeline
- 2026-05-29 - CVE-2026-44697 published to NVD
- 2026-06-02 - Last updated in NVD database
Technical Details for CVE-2026-44697
Vulnerability Analysis
The vulnerability is a classic decompression bomb pattern. Batch.Decompress in data/batch/batch.go expands attacker-supplied compressed payloads without validating the projected output size against a safe upper bound. Because the function trusts encoded length fields and compression ratios from untrusted peers, an attacker can craft a small input that expands by several orders of magnitude. The Go runtime allocates heap memory to satisfy the decompression, exhausting available RAM and prompting the kernel OOM killer to terminate the process. Network reachability and gossip propagation amplify the impact: any peer subscribed to an intercepted topic can deliver the payload, and the protocol layer forwards it to additional nodes before the receiving validator crashes.
Root Cause
The root cause is missing bounds enforcement during batch decompression. Batch.Decompress does not cap the decompressed buffer length, reject implausible expansion ratios, or stream output with a hard memory ceiling. This maps to [CWE-409], improper handling of highly compressed data.
Attack Vector
The attack vector is network-based and requires no authentication or user interaction. An attacker connects as a peer, subscribes to a topic served by MultiDataInterceptor, and publishes a single malformed batch payload under 50 KiB. The receiving validator decompresses the payload, allocates multi-gigabyte heap memory, and is terminated by the OS. Repeated or fleet-wide application breaks consensus participation. See the GitHub Security Advisory for the maintainers' technical description.
Detection Methods for CVE-2026-44697
Indicators of Compromise
- Validator processes terminated by the Linux OOM killer shortly after receiving gossip traffic, visible in dmesg or journalctl -k output.
- Sudden multi-gigabyte resident set size (RSS) growth of the klever-go process within seconds of an inbound peer message.
- Repeated, correlated validator restarts across multiple nodes following propagation of a specific batch payload.
Detection Strategies
- Monitor process memory metrics for the Klever-Go binary and alert on rapid RSS expansion exceeding configured baselines.
- Inspect p2p logs for malformed or oversized batch messages routed through MultiDataInterceptor.
- Correlate node crash events across validators to identify gossip-driven fleet impact rather than isolated faults.
Monitoring Recommendations
- Export host and container memory metrics to a centralized observability stack and define hard thresholds tied to validator memory limits.
- Capture peer message metadata, including topic, sender peer ID, and payload size, to enable post-incident attribution.
- Track Klever-Go version inventory across the validator fleet to confirm patched builds are in production.
How to Mitigate CVE-2026-44697
Immediate Actions Required
- Upgrade all Klever-Go nodes to version 1.7.17 or later without delay.
- Restart validators on patched binaries and confirm successful peer reconnection and topic subscription.
- Audit peer lists and reduce exposure to untrusted peers where the protocol configuration allows.
Patch Information
The vulnerability is fixed in Klever-Go 1.7.17. The patch enforces safe bounds in Batch.Decompress so oversized or highly compressed payloads are rejected before heap allocation. Refer to the Klever-Go GHSA-87m7-qffr-542v advisory for release details and commit references.
Workarounds
- Constrain validator process memory using systemdMemoryMax or container memory limits so OOM events are contained and observable, while still upgrading as the primary remediation.
- Restrict inbound p2p connectivity to a known set of trusted peers where the deployment topology supports it.
- Increase monitoring sensitivity on MultiDataInterceptor topics until the patched binary is fully rolled out.
# Upgrade Klever-Go to the patched release
git clone https://github.com/klever-io/klever-go.git
cd klever-go
git checkout v1.7.17
make build
# Verify the running binary version before restoring service
./klever-go --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
