Klever-Go CVE-2026-52878

The target node must be running Klever-Go version 1.7.14, 1.7.15, 1.7.16, or 1.7.17. No special feature flag, non-default configuration, or elevated account permission is required - all nodes in these version ranges process incoming transaction gossip through the vulnerable path by default as part of normal P2P operation. Per the CVSS vector (PR:N), exploitation is unauthenticated; no on-chain account, validator key, stake, or funds are needed. The attacker must be able to deliver a message to the target node's libp2p P2P gossip port, which is a standard network-reachable condition for any participant in the Klever P2P overlay. The only factor limiting exploitation is network reachability: nodes behind strict firewalls that whitelist P2P peers to a known allowlist have a reduced but not eliminated attack surface, since the allowlist itself could contain attacker-controlled or compromised peers.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) accurately reflects the mechanics: the attack is trivially network-delivered, requires zero authentication or complexity, and achieves complete availability loss on the targeted node. The individual-node score undersells the systemic risk - because Klever uses a BLS validator set for consensus, an attacker who crashes enough validators in sequence or simultaneously can halt block production entirely. The 3-byte minimum payload makes bandwidth cost negligible for sustained or distributed delivery. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be quantified independently. No CISA KEV listing was identified, meaning confirmed active exploitation in the wild is unverified; however, the vendor's coordinated release language ('upgrade all nodes promptly') and the zero-prerequisites nature of the attack suggest operators should treat this as an active-threat priority regardless. There are no conflicting signals between the CVSS vector and the technical description - both align consistently on network-reachable, unauthenticated, availability-only impact.

An attacker with access to the Klever P2P network (any standard network peer) constructs a minimal 3-byte protobuf-encoded Transaction message in which the RawData embedded field is intentionally omitted, then gossips it to a target node via the libp2p pubsub transaction topic. The receiving node's synchronous validator dereferences the nil RawData pointer, panics, and the process terminates immediately without logging a recoverable error. By scripting this delivery against a list of known validator endpoints in rapid succession, the attacker drains the active BLS validator set below the threshold required for block production, causing a chain halt until operators manually restart nodes on a patched version.