CVE-2026-52878: Klever-Go Blockchain DoS Vulnerability

CVE-2026-52878 Overview

CVE-2026-52878 is a nil-pointer dereference vulnerability in Klever-Go, the Go implementation of the Klever blockchain protocol. Versions 1.7.14 through 1.7.17 crash when they decode a crafted protobuf Transaction message whose embedded RawData sub-message is omitted. The Klever-Go P2P layer validates every gossiped transaction synchronously inside the libp2p pubsub topic-validator callback. That callback dereferences tx.RawData.Version without a nil check, and no recover() is installed anywhere in the validation chain. A 3-byte protobuf message is sufficient to panic and terminate the node process [CWE-476].

Critical Impact
An unauthenticated remote attacker can crash Klever-Go validator nodes using a 3-byte protobuf message. Delivery to a sufficient portion of the BLS validator set halts block production and stalls the chain.

Affected Products

Klever-Go 1.7.14
Klever-Go 1.7.15 through 1.7.16
Klever-Go 1.7.17

Discovery Timeline

2026-08-07 - CVE-2026-52878 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-52878

Vulnerability Analysis

The defect is a missing nil check on a decoded protobuf sub-message. Klever-Go transactions carry a RawData sub-message that contains fields such as Version. Protobuf permits any message field to be absent on the wire. When RawData is omitted, the Go decoder leaves the pointer set to nil rather than instantiating a zero-value struct.

Every gossiped transaction on the Klever-Go P2P network is decoded and validated synchronously inside the libp2p pubsub topic-validator callback. Inside that callback, txVersionChecker.CheckTxVersion dereferences tx.RawData.Version without first checking whether tx.RawData is nil. The dereference raises a runtime panic.

Neither the libp2p pubsub validation worker nor the Klever network/p2p layer installs recover(). The panic unwinds through the validator goroutine and terminates the node process. Because validation runs on gossiped traffic, no authentication, stake, funds, or on-chain account is required.

Root Cause

The root cause is an unchecked pointer dereference on a protobuf optional sub-message combined with the absence of panic recovery in the P2P validation path. See the GitHub Security Advisory GHSA-rm5c-5x2p-48wr for technical details.

Attack Vector

An attacker connects to the Klever-Go P2P mesh as an ordinary peer and gossips a malformed protobuf Transaction with RawData omitted. The payload is 3 bytes. Every subscribed node decodes the message, invokes CheckTxVersion, and panics. Targeting enough BLS validator nodes at once halts block production and produces a chain halt. Refer to the GitHub Security Advisory GHSA-rm5c-5x2p-48wr for exploitation details.

Detection Methods for CVE-2026-52878

Indicators of Compromise

Unexpected termination of the klever-go process with a Go runtime panic referencing nil pointer dereference in txVersionChecker.CheckTxVersion.
Correlated node crashes across multiple validators within a short window on the same pubsub topic.
Stalled block height or missed BLS signatures immediately following a spike in inbound P2P transaction gossip.

Detection Strategies

Parse node stdout, stderr, and systemd journal logs for Go panic stack traces originating in the libp2p pubsub validator callback.
Inspect pubsub message sizes and reject unusually small (sub-16-byte) transaction payloads at the network edge for triage.
Alert on validator process restarts that coincide with elevated inbound P2P traffic from newly seen peers.

Monitoring Recommendations

Instrument the Klever-Go node with process-liveness and restart-count metrics exported to your SIEM.
Track chain-halt indicators such as block time deviation, missed proposer slots, and BLS quorum drops.
Retain P2P peer connection logs to identify the source addresses that gossiped the crashing payload.

How to Mitigate CVE-2026-52878

Immediate Actions Required

Upgrade all Klever-Go nodes and validators to version 1.7.18 or later without delay.
Restrict inbound P2P peering to known validators and trusted sentries until upgrades complete.
Confirm validator processes are supervised so any residual crash is restarted and logged for review.

Patch Information

The issue is fixed in Klever-Go 1.7.18. Version 1.7.18 adds a nil check for tx.RawData in the transaction version validator and prevents propagation of malformed protobuf transactions. Download the release from the GitHub Release v1.7.18 page.

Workarounds

Place validator nodes behind sentry nodes running 1.7.18 so malformed gossip is filtered before reaching signing nodes.
Reduce the pubsub peer count for validators and require peer identity allowlisting during the upgrade window.
Deploy process supervision (for example, systemd with Restart=always) to shorten downtime if a crash occurs before patching.

bash

# Upgrade Klever-Go to the fixed release
git fetch --tags
git checkout v1.7.18
make build
systemctl restart klever-go
klever-go version   # expect: v1.7.18