github.com/klever-io/klever-go
Official Go implementation of the Klever blockchain protocol — high-performance node, KVM smart contracts, and CLI tools
View on Github
Activity
- Latest release
- 1w ago
- Total releases
- 14
- Cadence
- ~21 days
- Last 12 months
- 13
Reach
- Stars
- 33
Details
- First release
- Sep 26, 2025
| Version | Released | |
|---|---|---|
v1.7.22-rc1
pre
2 CVEs
CVE-2026-55763
GO-2026-6323
GHSA-v358-wf77-39xv
Sep 02, 2026
klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits in github.com/klever-io/klever-go klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits in github.com/klever-io/klever-go. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/klever-io/klever-go before v1.7.19-rc4. References Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-44697
GO-2026-5246
GHSA-87m7-qffr-542v
Jun 25, 2026
Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payload in github.com/klever-io/klever-go Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payload in github.com/klever-io/klever-go References Updated Jun 25, 2026 · Source: OSV.dev |
v1.7.22-rc1
pre
Dependencies (53)
+ 45 more |
|
v1.7.22
patch
2 CVEs
CVE-2026-55763
GO-2026-6323
GHSA-v358-wf77-39xv
Sep 02, 2026
klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits in github.com/klever-io/klever-go klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits in github.com/klever-io/klever-go. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/klever-io/klever-go before v1.7.19-rc4. References Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-44697
GO-2026-5246
GHSA-87m7-qffr-542v
Jun 25, 2026
Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payload in github.com/klever-io/klever-go Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payload in github.com/klever-io/klever-go References Updated Jun 25, 2026 · Source: OSV.dev |
v1.7.22
patch
Dependencies (53)
+ 45 more |
|
v1.7.22-rc0
pre
2 CVEs
CVE-2026-55763
GO-2026-6323
GHSA-v358-wf77-39xv
Sep 02, 2026
klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits in github.com/klever-io/klever-go klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits in github.com/klever-io/klever-go. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/klever-io/klever-go before v1.7.19-rc4. References Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-44697
GO-2026-5246
GHSA-87m7-qffr-542v
Jun 25, 2026
Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payload in github.com/klever-io/klever-go Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payload in github.com/klever-io/klever-go References Updated Jun 25, 2026 · Source: OSV.dev |
v1.7.22-rc0
pre
Dependencies (53)
+ 45 more |
|
v1.7.21
patch
2 CVEs
CVE-2026-55763
GO-2026-6323
GHSA-v358-wf77-39xv
Sep 02, 2026
klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits in github.com/klever-io/klever-go klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits in github.com/klever-io/klever-go. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/klever-io/klever-go before v1.7.19-rc4. References Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-44697
GO-2026-5246
GHSA-87m7-qffr-542v
Jun 25, 2026
Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payload in github.com/klever-io/klever-go Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payload in github.com/klever-io/klever-go References Updated Jun 25, 2026 · Source: OSV.dev |
v1.7.21
patch
Dependencies (53)
+ 45 more |
|
v1.7.21-rc3
pre
2 CVEs
CVE-2026-55763
GO-2026-6323
GHSA-v358-wf77-39xv
Sep 02, 2026
klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits in github.com/klever-io/klever-go klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits in github.com/klever-io/klever-go. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/klever-io/klever-go before v1.7.19-rc4. References Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-44697
GO-2026-5246
GHSA-87m7-qffr-542v
Jun 25, 2026
Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payload in github.com/klever-io/klever-go Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payload in github.com/klever-io/klever-go References Updated Jun 25, 2026 · Source: OSV.dev |
v1.7.21-rc3
pre
Dependencies (53)
+ 45 more |
|
v1.7.21-rc2
pre
2 CVEs
CVE-2026-55763
GO-2026-6323
GHSA-v358-wf77-39xv
Sep 02, 2026
klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits in github.com/klever-io/klever-go klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits in github.com/klever-io/klever-go. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/klever-io/klever-go before v1.7.19-rc4. References Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-44697
GO-2026-5246
GHSA-87m7-qffr-542v
Jun 25, 2026
Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payload in github.com/klever-io/klever-go Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payload in github.com/klever-io/klever-go References Updated Jun 25, 2026 · Source: OSV.dev |
v1.7.21-rc2
pre
Dependencies (54)
+ 46 more |
|
v1.7.21-rc1
pre
2 CVEs
CVE-2026-55763
GO-2026-6323
GHSA-v358-wf77-39xv
Sep 02, 2026
klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits in github.com/klever-io/klever-go klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits in github.com/klever-io/klever-go. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/klever-io/klever-go before v1.7.19-rc4. References Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-44697
GO-2026-5246
GHSA-87m7-qffr-542v
Jun 25, 2026
Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payload in github.com/klever-io/klever-go Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payload in github.com/klever-io/klever-go References Updated Jun 25, 2026 · Source: OSV.dev |
v1.7.21-rc1
pre
Dependencies (54)
+ 46 more |
|
v1.7.20
patch
2 CVEs
CVE-2026-55763
GO-2026-6323
GHSA-v358-wf77-39xv
Sep 02, 2026
klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits in github.com/klever-io/klever-go klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits in github.com/klever-io/klever-go. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/klever-io/klever-go before v1.7.19-rc4. References Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-44697
GO-2026-5246
GHSA-87m7-qffr-542v
Jun 25, 2026
Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payload in github.com/klever-io/klever-go Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payload in github.com/klever-io/klever-go References Updated Jun 25, 2026 · Source: OSV.dev |
v1.7.20
patch
Dependencies (54)
+ 46 more |
|
v1.7.19
patch
8 CVEs
CVE-2026-82405
GO-2026-6582
GHSA-97cv-x867-6xhm
Oct 01, 2026
Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated caller in github.com/klever-io/klever-go Klever-Go Account takeover: Fixed in
1.7.20
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-82409
GO-2026-6585
GHSA-7c7c-373r-gfjj
Oct 01, 2026
Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery in github.com/klever-io/klever-go Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery in github.com/klever-io/klever-go Fixed in
1.7.20
References
Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-86065
GO-2026-6581
GHSA-4fwh-wrm6-97xm
Oct 01, 2026
Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS) in github.com/klever-io/klever-go Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS) in github.com/klever-io/klever-go Fixed in
1.7.20
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-82406
GO-2026-6584
GHSA-26r5-4mm2-px5c
Oct 01, 2026
Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace in github.com/klever-io/klever-go Klever-Go: Zombie-order theft: Fixed in
1.7.20
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-86064
GO-2026-6583
GHSA-9v8p-frvj-2pcm
Oct 01, 2026
Klever-Go: /log controls global node logging in github.com/klever-io/klever-go Klever-Go: /log controls global node logging in github.com/klever-io/klever-go Fixed in
1.7.20
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-82407
GO-2026-6586
GHSA-9wh6-9hq7-9688
Oct 01, 2026
Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS in github.com/klever-io/klever-go Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS in github.com/klever-io/klever-go Fixed in
1.7.20
References
Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-55763
GO-2026-6323
GHSA-v358-wf77-39xv
Sep 02, 2026
klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits in github.com/klever-io/klever-go klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits in github.com/klever-io/klever-go. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/klever-io/klever-go before v1.7.19-rc4. References Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-44697
GO-2026-5246
GHSA-87m7-qffr-542v
Jun 25, 2026
Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payload in github.com/klever-io/klever-go Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payload in github.com/klever-io/klever-go References Updated Jun 25, 2026 · Source: OSV.dev |
v1.7.19
patch
Dependencies (54)
+ 46 more |
|
v1.7.18
patch
11 CVEs
CVE-2026-82405
GO-2026-6582
GHSA-97cv-x867-6xhm
Oct 01, 2026
Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated caller in github.com/klever-io/klever-go Klever-Go Account takeover: Fixed in
1.7.20
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-82409
GO-2026-6585
GHSA-7c7c-373r-gfjj
Oct 01, 2026
Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery in github.com/klever-io/klever-go Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery in github.com/klever-io/klever-go Fixed in
1.7.20
References
Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-86065
GO-2026-6581
GHSA-4fwh-wrm6-97xm
Oct 01, 2026
Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS) in github.com/klever-io/klever-go Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS) in github.com/klever-io/klever-go Fixed in
1.7.20
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-82406
GO-2026-6584
GHSA-26r5-4mm2-px5c
Oct 01, 2026
Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace in github.com/klever-io/klever-go Klever-Go: Zombie-order theft: Fixed in
1.7.20
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-86064
GO-2026-6583
GHSA-9v8p-frvj-2pcm
Oct 01, 2026
Klever-Go: /log controls global node logging in github.com/klever-io/klever-go Klever-Go: /log controls global node logging in github.com/klever-io/klever-go Fixed in
1.7.20
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-82407
GO-2026-6586
GHSA-9wh6-9hq7-9688
Oct 01, 2026
Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS in github.com/klever-io/klever-go Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS in github.com/klever-io/klever-go Fixed in
1.7.20
References
Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-55763
GO-2026-6323
GHSA-v358-wf77-39xv
Sep 02, 2026
klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits in github.com/klever-io/klever-go klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits in github.com/klever-io/klever-go. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/klever-io/klever-go before v1.7.19-rc4. References Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-54755
GO-2026-6310
GHSA-cgc5-v3f2-8m2v
Sep 02, 2026
Klever: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token) in github.com/klever-io/klever-go Klever: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token) in github.com/klever-io/klever-go Fixed in
1.7.19
References Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-55764
GO-2026-6330
GHSA-mrpp-v6pg-p54x
Sep 02, 2026
klever-go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply in github.com/klever-io/klever-go klever-go: SFT add-quantity Fixed in
1.7.19
References Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-54754
GO-2026-6315
GHSA-p7gw-2pcp-5pf8
Sep 02, 2026
Klever: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped) in github.com/klever-io/klever-go Klever: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped) in github.com/klever-io/klever-go Fixed in
1.7.19
References Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-44697
GO-2026-5246
GHSA-87m7-qffr-542v
Jun 25, 2026
Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payload in github.com/klever-io/klever-go Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payload in github.com/klever-io/klever-go References Updated Jun 25, 2026 · Source: OSV.dev |
v1.7.18
patch
Dependencies (54)
+ 46 more |
|
v1.7.17
patch
16 CVEs
CVE-2026-82405
GO-2026-6582
GHSA-97cv-x867-6xhm
Oct 01, 2026
Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated caller in github.com/klever-io/klever-go Klever-Go Account takeover: Fixed in
1.7.20
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-82409
GO-2026-6585
GHSA-7c7c-373r-gfjj
Oct 01, 2026
Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery in github.com/klever-io/klever-go Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery in github.com/klever-io/klever-go Fixed in
1.7.20
References
Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-86065
GO-2026-6581
GHSA-4fwh-wrm6-97xm
Oct 01, 2026
Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS) in github.com/klever-io/klever-go Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS) in github.com/klever-io/klever-go Fixed in
1.7.20
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-82406
GO-2026-6584
GHSA-26r5-4mm2-px5c
Oct 01, 2026
Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace in github.com/klever-io/klever-go Klever-Go: Zombie-order theft: Fixed in
1.7.20
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-86064
GO-2026-6583
GHSA-9v8p-frvj-2pcm
Oct 01, 2026
Klever-Go: /log controls global node logging in github.com/klever-io/klever-go Klever-Go: /log controls global node logging in github.com/klever-io/klever-go Fixed in
1.7.20
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-82407
GO-2026-6586
GHSA-9wh6-9hq7-9688
Oct 01, 2026
Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS in github.com/klever-io/klever-go Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS in github.com/klever-io/klever-go Fixed in
1.7.20
References
Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-55763
GO-2026-6323
GHSA-v358-wf77-39xv
Sep 02, 2026
klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits in github.com/klever-io/klever-go klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits in github.com/klever-io/klever-go. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/klever-io/klever-go before v1.7.19-rc4. References Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-54755
GO-2026-6310
GHSA-cgc5-v3f2-8m2v
Sep 02, 2026
Klever: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token) in github.com/klever-io/klever-go Klever: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token) in github.com/klever-io/klever-go Fixed in
1.7.19
References Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-55764
GO-2026-6330
GHSA-mrpp-v6pg-p54x
Sep 02, 2026
klever-go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply in github.com/klever-io/klever-go klever-go: SFT add-quantity Fixed in
1.7.19
References Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-54754
GO-2026-6315
GHSA-p7gw-2pcp-5pf8
Sep 02, 2026
Klever: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped) in github.com/klever-io/klever-go Klever: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped) in github.com/klever-io/klever-go Fixed in
1.7.19
References Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-47249
GO-2026-5685
GHSA-w342-mj6g-v9c4
Jun 25, 2026
Klever-Go KVM: Hash-array amplification in P2P resolver request handling in github.com/klever-io/klever-go Klever-Go KVM: Hash-array amplification in P2P resolver request handling in github.com/klever-io/klever-go Fixed in
1.7.18
References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-52880
GO-2026-5686
GHSA-w4c6-7r69-w7j9
Jun 25, 2026
klever-go: REST API slow-header connection exhaustion via Gin Engine.Run in github.com/klever-io/klever-go klever-go: REST API slow-header connection exhaustion via Gin Engine.Run in github.com/klever-io/klever-go Fixed in
1.7.18
References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-52878
GO-2026-5628
GHSA-rm5c-5x2p-48wr
Jun 25, 2026
Klever-Go KVM: Unauthenticated remote node crash (nil-pointer DoS) in klever-go P2P transaction interceptor (txVersionChecker nil RawData) - potential chain halt in github.com/klever-io/klever-go Klever-Go KVM: Unauthenticated remote node crash (nil-pointer DoS) in klever-go P2P transaction interceptor (txVersionChecker nil RawData) - potential chain halt in github.com/klever-io/klever-go Fixed in
1.7.18
References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-52879
GO-2026-5424
GHSA-hf2g-6j7h-98wg
Jun 25, 2026
klever-go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoS in github.com/klever-io/klever-go klever-go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoS in github.com/klever-io/klever-go Fixed in
1.7.18
References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-49343
GO-2026-5379
GHSA-fw38-pc54-jvx9
Jun 25, 2026
Klever-Go KVM: Throttler slot leak in trie account-data sync causes epoch bootstrap / state sync DoS in github.com/klever-io/klever-go Klever-Go KVM: Throttler slot leak in trie account-data sync causes epoch bootstrap / state sync DoS in github.com/klever-io/klever-go Fixed in
1.7.18
References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-44697
GO-2026-5246
GHSA-87m7-qffr-542v
Jun 25, 2026
Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payload in github.com/klever-io/klever-go Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payload in github.com/klever-io/klever-go References Updated Jun 25, 2026 · Source: OSV.dev |
v1.7.17
patch
Dependencies (54)
+ 46 more |
|
v1.7.16
patch
18 CVEs
CVE-2026-82405
GO-2026-6582
GHSA-97cv-x867-6xhm
Oct 01, 2026
Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated caller in github.com/klever-io/klever-go Klever-Go Account takeover: Fixed in
1.7.20
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-82409
GO-2026-6585
GHSA-7c7c-373r-gfjj
Oct 01, 2026
Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery in github.com/klever-io/klever-go Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery in github.com/klever-io/klever-go Fixed in
1.7.20
References
Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-86065
GO-2026-6581
GHSA-4fwh-wrm6-97xm
Oct 01, 2026
Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS) in github.com/klever-io/klever-go Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS) in github.com/klever-io/klever-go Fixed in
1.7.20
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-82406
GO-2026-6584
GHSA-26r5-4mm2-px5c
Oct 01, 2026
Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace in github.com/klever-io/klever-go Klever-Go: Zombie-order theft: Fixed in
1.7.20
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-86064
GO-2026-6583
GHSA-9v8p-frvj-2pcm
Oct 01, 2026
Klever-Go: /log controls global node logging in github.com/klever-io/klever-go Klever-Go: /log controls global node logging in github.com/klever-io/klever-go Fixed in
1.7.20
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-82407
GO-2026-6586
GHSA-9wh6-9hq7-9688
Oct 01, 2026
Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS in github.com/klever-io/klever-go Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS in github.com/klever-io/klever-go Fixed in
1.7.20
References
Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-55763
GO-2026-6323
GHSA-v358-wf77-39xv
Sep 02, 2026
klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits in github.com/klever-io/klever-go klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits in github.com/klever-io/klever-go. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/klever-io/klever-go before v1.7.19-rc4. References Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-54755
GO-2026-6310
GHSA-cgc5-v3f2-8m2v
Sep 02, 2026
Klever: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token) in github.com/klever-io/klever-go Klever: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token) in github.com/klever-io/klever-go Fixed in
1.7.19
References Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-55764
GO-2026-6330
GHSA-mrpp-v6pg-p54x
Sep 02, 2026
klever-go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply in github.com/klever-io/klever-go klever-go: SFT add-quantity Fixed in
1.7.19
References Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-54754
GO-2026-6315
GHSA-p7gw-2pcp-5pf8
Sep 02, 2026
Klever: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped) in github.com/klever-io/klever-go Klever: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped) in github.com/klever-io/klever-go Fixed in
1.7.19
References Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-47249
GO-2026-5685
GHSA-w342-mj6g-v9c4
Jun 25, 2026
Klever-Go KVM: Hash-array amplification in P2P resolver request handling in github.com/klever-io/klever-go Klever-Go KVM: Hash-array amplification in P2P resolver request handling in github.com/klever-io/klever-go Fixed in
1.7.18
References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-52880
GO-2026-5686
GHSA-w4c6-7r69-w7j9
Jun 25, 2026
klever-go: REST API slow-header connection exhaustion via Gin Engine.Run in github.com/klever-io/klever-go klever-go: REST API slow-header connection exhaustion via Gin Engine.Run in github.com/klever-io/klever-go Fixed in
1.7.18
References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-52878
GO-2026-5628
GHSA-rm5c-5x2p-48wr
Jun 25, 2026
Klever-Go KVM: Unauthenticated remote node crash (nil-pointer DoS) in klever-go P2P transaction interceptor (txVersionChecker nil RawData) - potential chain halt in github.com/klever-io/klever-go Klever-Go KVM: Unauthenticated remote node crash (nil-pointer DoS) in klever-go P2P transaction interceptor (txVersionChecker nil RawData) - potential chain halt in github.com/klever-io/klever-go Fixed in
1.7.18
References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-52879
GO-2026-5424
GHSA-hf2g-6j7h-98wg
Jun 25, 2026
klever-go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoS in github.com/klever-io/klever-go klever-go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoS in github.com/klever-io/klever-go Fixed in
1.7.18
References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-46403
GO-2026-5461
GHSA-jc6w-wmfc-fh33
Jun 25, 2026
Klever-Go KVM read-only execution can commit contract delete and upgrade side effects in github.com/klever-io/klever-go Klever-Go KVM read-only execution can commit contract delete and upgrade side effects in github.com/klever-io/klever-go Fixed in
1.7.17
References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-49343
GO-2026-5379
GHSA-fw38-pc54-jvx9
Jun 25, 2026
Klever-Go KVM: Throttler slot leak in trie account-data sync causes epoch bootstrap / state sync DoS in github.com/klever-io/klever-go Klever-Go KVM: Throttler slot leak in trie account-data sync causes epoch bootstrap / state sync DoS in github.com/klever-io/klever-go Fixed in
1.7.18
References Updated Jun 25, 2026 · Source: OSV.dev
GO-2026-5204
GHSA-74m6-4hjp-7226
Jun 25, 2026
Klever-Go P2P MultiDataInterceptor leaks global throttler slots on malformed compressed batches (DoS) in github.com/klever-io/klever-go Klever-Go P2P MultiDataInterceptor leaks global throttler slots on malformed compressed batches (DoS) in github.com/klever-io/klever-go Fixed in
1.7.17
References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-44697
GO-2026-5246
GHSA-87m7-qffr-542v
Jun 25, 2026
Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payload in github.com/klever-io/klever-go Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payload in github.com/klever-io/klever-go References Updated Jun 25, 2026 · Source: OSV.dev |
v1.7.16
patch
Dependencies (54)
+ 46 more |
|
v1.7.15
patch
18 CVEs
CVE-2026-82405
GO-2026-6582
GHSA-97cv-x867-6xhm
Oct 01, 2026
Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated caller in github.com/klever-io/klever-go Klever-Go Account takeover: Fixed in
1.7.20
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-82409
GO-2026-6585
GHSA-7c7c-373r-gfjj
Oct 01, 2026
Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery in github.com/klever-io/klever-go Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery in github.com/klever-io/klever-go Fixed in
1.7.20
References
Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-86065
GO-2026-6581
GHSA-4fwh-wrm6-97xm
Oct 01, 2026
Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS) in github.com/klever-io/klever-go Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS) in github.com/klever-io/klever-go Fixed in
1.7.20
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-82406
GO-2026-6584
GHSA-26r5-4mm2-px5c
Oct 01, 2026
Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace in github.com/klever-io/klever-go Klever-Go: Zombie-order theft: Fixed in
1.7.20
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-86064
GO-2026-6583
GHSA-9v8p-frvj-2pcm
Oct 01, 2026
Klever-Go: /log controls global node logging in github.com/klever-io/klever-go Klever-Go: /log controls global node logging in github.com/klever-io/klever-go Fixed in
1.7.20
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-82407
GO-2026-6586
GHSA-9wh6-9hq7-9688
Oct 01, 2026
Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS in github.com/klever-io/klever-go Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS in github.com/klever-io/klever-go Fixed in
1.7.20
References
Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-55763
GO-2026-6323
GHSA-v358-wf77-39xv
Sep 02, 2026
klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits in github.com/klever-io/klever-go klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits in github.com/klever-io/klever-go. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/klever-io/klever-go before v1.7.19-rc4. References Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-54755
GO-2026-6310
GHSA-cgc5-v3f2-8m2v
Sep 02, 2026
Klever: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token) in github.com/klever-io/klever-go Klever: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token) in github.com/klever-io/klever-go Fixed in
1.7.19
References Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-55764
GO-2026-6330
GHSA-mrpp-v6pg-p54x
Sep 02, 2026
klever-go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply in github.com/klever-io/klever-go klever-go: SFT add-quantity Fixed in
1.7.19
References Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-54754
GO-2026-6315
GHSA-p7gw-2pcp-5pf8
Sep 02, 2026
Klever: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped) in github.com/klever-io/klever-go Klever: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped) in github.com/klever-io/klever-go Fixed in
1.7.19
References Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-47249
GO-2026-5685
GHSA-w342-mj6g-v9c4
Jun 25, 2026
Klever-Go KVM: Hash-array amplification in P2P resolver request handling in github.com/klever-io/klever-go Klever-Go KVM: Hash-array amplification in P2P resolver request handling in github.com/klever-io/klever-go Fixed in
1.7.18
References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-52880
GO-2026-5686
GHSA-w4c6-7r69-w7j9
Jun 25, 2026
klever-go: REST API slow-header connection exhaustion via Gin Engine.Run in github.com/klever-io/klever-go klever-go: REST API slow-header connection exhaustion via Gin Engine.Run in github.com/klever-io/klever-go Fixed in
1.7.18
References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-52878
GO-2026-5628
GHSA-rm5c-5x2p-48wr
Jun 25, 2026
Klever-Go KVM: Unauthenticated remote node crash (nil-pointer DoS) in klever-go P2P transaction interceptor (txVersionChecker nil RawData) - potential chain halt in github.com/klever-io/klever-go Klever-Go KVM: Unauthenticated remote node crash (nil-pointer DoS) in klever-go P2P transaction interceptor (txVersionChecker nil RawData) - potential chain halt in github.com/klever-io/klever-go Fixed in
1.7.18
References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-52879
GO-2026-5424
GHSA-hf2g-6j7h-98wg
Jun 25, 2026
klever-go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoS in github.com/klever-io/klever-go klever-go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoS in github.com/klever-io/klever-go Fixed in
1.7.18
References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-46403
GO-2026-5461
GHSA-jc6w-wmfc-fh33
Jun 25, 2026
Klever-Go KVM read-only execution can commit contract delete and upgrade side effects in github.com/klever-io/klever-go Klever-Go KVM read-only execution can commit contract delete and upgrade side effects in github.com/klever-io/klever-go Fixed in
1.7.17
References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-49343
GO-2026-5379
GHSA-fw38-pc54-jvx9
Jun 25, 2026
Klever-Go KVM: Throttler slot leak in trie account-data sync causes epoch bootstrap / state sync DoS in github.com/klever-io/klever-go Klever-Go KVM: Throttler slot leak in trie account-data sync causes epoch bootstrap / state sync DoS in github.com/klever-io/klever-go Fixed in
1.7.18
References Updated Jun 25, 2026 · Source: OSV.dev
GO-2026-5204
GHSA-74m6-4hjp-7226
Jun 25, 2026
Klever-Go P2P MultiDataInterceptor leaks global throttler slots on malformed compressed batches (DoS) in github.com/klever-io/klever-go Klever-Go P2P MultiDataInterceptor leaks global throttler slots on malformed compressed batches (DoS) in github.com/klever-io/klever-go Fixed in
1.7.17
References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-44697
GO-2026-5246
GHSA-87m7-qffr-542v
Jun 25, 2026
Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payload in github.com/klever-io/klever-go Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payload in github.com/klever-io/klever-go References Updated Jun 25, 2026 · Source: OSV.dev |
v1.7.15
patch
Dependencies (54)
+ 46 more |
|
v1.7.14
initial
18 CVEs
CVE-2026-82405
GO-2026-6582
GHSA-97cv-x867-6xhm
Oct 01, 2026
Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated caller in github.com/klever-io/klever-go Klever-Go Account takeover: Fixed in
1.7.20
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-82409
GO-2026-6585
GHSA-7c7c-373r-gfjj
Oct 01, 2026
Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery in github.com/klever-io/klever-go Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery in github.com/klever-io/klever-go Fixed in
1.7.20
References
Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-86065
GO-2026-6581
GHSA-4fwh-wrm6-97xm
Oct 01, 2026
Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS) in github.com/klever-io/klever-go Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS) in github.com/klever-io/klever-go Fixed in
1.7.20
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-82406
GO-2026-6584
GHSA-26r5-4mm2-px5c
Oct 01, 2026
Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace in github.com/klever-io/klever-go Klever-Go: Zombie-order theft: Fixed in
1.7.20
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-86064
GO-2026-6583
GHSA-9v8p-frvj-2pcm
Oct 01, 2026
Klever-Go: /log controls global node logging in github.com/klever-io/klever-go Klever-Go: /log controls global node logging in github.com/klever-io/klever-go Fixed in
1.7.20
References Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-82407
GO-2026-6586
GHSA-9wh6-9hq7-9688
Oct 01, 2026
Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS in github.com/klever-io/klever-go Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS in github.com/klever-io/klever-go Fixed in
1.7.20
References
Updated Oct 01, 2026 · Source: OSV.dev
CVE-2026-55763
GO-2026-6323
GHSA-v358-wf77-39xv
Sep 02, 2026
klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits in github.com/klever-io/klever-go klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits in github.com/klever-io/klever-go. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/klever-io/klever-go before v1.7.19-rc4. References Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-54755
GO-2026-6310
GHSA-cgc5-v3f2-8m2v
Sep 02, 2026
Klever: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token) in github.com/klever-io/klever-go Klever: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token) in github.com/klever-io/klever-go Fixed in
1.7.19
References Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-55764
GO-2026-6330
GHSA-mrpp-v6pg-p54x
Sep 02, 2026
klever-go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply in github.com/klever-io/klever-go klever-go: SFT add-quantity Fixed in
1.7.19
References Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-54754
GO-2026-6315
GHSA-p7gw-2pcp-5pf8
Sep 02, 2026
Klever: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped) in github.com/klever-io/klever-go Klever: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped) in github.com/klever-io/klever-go Fixed in
1.7.19
References Updated Sep 02, 2026 · Source: OSV.dev
CVE-2026-47249
GO-2026-5685
GHSA-w342-mj6g-v9c4
Jun 25, 2026
Klever-Go KVM: Hash-array amplification in P2P resolver request handling in github.com/klever-io/klever-go Klever-Go KVM: Hash-array amplification in P2P resolver request handling in github.com/klever-io/klever-go Fixed in
1.7.18
References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-52880
GO-2026-5686
GHSA-w4c6-7r69-w7j9
Jun 25, 2026
klever-go: REST API slow-header connection exhaustion via Gin Engine.Run in github.com/klever-io/klever-go klever-go: REST API slow-header connection exhaustion via Gin Engine.Run in github.com/klever-io/klever-go Fixed in
1.7.18
References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-52878
GO-2026-5628
GHSA-rm5c-5x2p-48wr
Jun 25, 2026
Klever-Go KVM: Unauthenticated remote node crash (nil-pointer DoS) in klever-go P2P transaction interceptor (txVersionChecker nil RawData) - potential chain halt in github.com/klever-io/klever-go Klever-Go KVM: Unauthenticated remote node crash (nil-pointer DoS) in klever-go P2P transaction interceptor (txVersionChecker nil RawData) - potential chain halt in github.com/klever-io/klever-go Fixed in
1.7.18
References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-52879
GO-2026-5424
GHSA-hf2g-6j7h-98wg
Jun 25, 2026
klever-go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoS in github.com/klever-io/klever-go klever-go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoS in github.com/klever-io/klever-go Fixed in
1.7.18
References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-46403
GO-2026-5461
GHSA-jc6w-wmfc-fh33
Jun 25, 2026
Klever-Go KVM read-only execution can commit contract delete and upgrade side effects in github.com/klever-io/klever-go Klever-Go KVM read-only execution can commit contract delete and upgrade side effects in github.com/klever-io/klever-go Fixed in
1.7.17
References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-49343
GO-2026-5379
GHSA-fw38-pc54-jvx9
Jun 25, 2026
Klever-Go KVM: Throttler slot leak in trie account-data sync causes epoch bootstrap / state sync DoS in github.com/klever-io/klever-go Klever-Go KVM: Throttler slot leak in trie account-data sync causes epoch bootstrap / state sync DoS in github.com/klever-io/klever-go Fixed in
1.7.18
References Updated Jun 25, 2026 · Source: OSV.dev
GO-2026-5204
GHSA-74m6-4hjp-7226
Jun 25, 2026
Klever-Go P2P MultiDataInterceptor leaks global throttler slots on malformed compressed batches (DoS) in github.com/klever-io/klever-go Klever-Go P2P MultiDataInterceptor leaks global throttler slots on malformed compressed batches (DoS) in github.com/klever-io/klever-go Fixed in
1.7.17
References Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-44697
GO-2026-5246
GHSA-87m7-qffr-542v
Jun 25, 2026
Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payload in github.com/klever-io/klever-go Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payload in github.com/klever-io/klever-go References Updated Jun 25, 2026 · Source: OSV.dev |
v1.7.14
initial
Dependencies (54)
+ 46 more |