Answer in brief
CVE-2026-52878 records a High severity vulnerability in Klever-Go: Unauthenticated nil-pointer DoS in P2P transaction validation can halt the chain. The current sources do not mark it as known exploited. The current feed maps klever-io/klever-go (generic), github.com/klever-io/klever-go (go). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps klever-io/klever-go (generic), github.com/klever-io/klever-go (go). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| klever-io/klever-gogeneric | >= 1.7.14, < 1.7.18 | Not reported |
| github.com/klever-io/klever-gogo | >=1.7.14,<=1.7.17 | 1.7.18 |
Published upstream
Aug 7, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 7, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 11, 2026
Klever-Go is the Go implementation of the Klever blockchain protocol. Versions 1.7.14 through 1.7.17 are vulnerable to a nil-pointer panic triggered by a protobuf Transaction whose embedded RawData sub-message is omitted. This omission causes RawData to decode to nil. Every transaction gossiped on the Klever-Go P2P network is decoded and validated synchronously inside the libp2p pubsub topic-validator callback, where txVersionChecker.CheckTxVersion dereferences tx.RawData.Version with no nil check. Because the libp2p pubsub callback, the underlying go-libp2p-pubsub validation worker, and Klever's own network/p2p layer install no recover(), the panic propagates and crashes the entire node process. The attacker payload is a 3-byte protobuf message; no validator key, stake, funds, or on-chain account is required, and delivery aimed at enough of the BLS validator set can halt block production, resulting in a chain halt. This issue has been fixed in version 1.7.18.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-52878 records a High severity vulnerability in Klever-Go: Unauthenticated nil-pointer DoS in P2P transaction validation can halt the chain. The current sources do not mark it as known exploited. The current feed maps klever-io/klever-go (generic), github.com/klever-io/klever-go (go). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps klever-io/klever-go (generic), github.com/klever-io/klever-go (go). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| klever-io/klever-gogeneric | >= 1.7.14, < 1.7.18 | Not reported |
| github.com/klever-io/klever-gogo | >=1.7.14,<=1.7.17 | 1.7.18 |
Published upstream
Aug 7, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 7, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 11, 2026
Klever-Go is the Go implementation of the Klever blockchain protocol. Versions 1.7.14 through 1.7.17 are vulnerable to a nil-pointer panic triggered by a protobuf Transaction whose embedded RawData sub-message is omitted. This omission causes RawData to decode to nil. Every transaction gossiped on the Klever-Go P2P network is decoded and validated synchronously inside the libp2p pubsub topic-validator callback, where txVersionChecker.CheckTxVersion dereferences tx.RawData.Version with no nil check. Because the libp2p pubsub callback, the underlying go-libp2p-pubsub validation worker, and Klever's own network/p2p layer install no recover(), the panic propagates and crashes the entire node process. The attacker payload is a 3-byte protobuf message; no validator key, stake, funds, or on-chain account is required, and delivery aimed at enough of the BLS validator set can halt block production, resulting in a chain halt. This issue has been fixed in version 1.7.18.
Quoted source text, attributed separately from HOL analysis.