Klever-Go CVE-2026-52879

The attacker must be able to establish a libp2p peer connection to the targeted node's P2P port and open a DirectSendID stream. In a public blockchain network, this is a default-open capability - any reachable peer can connect without credentials. The messages used must be well-formed TopicMessage envelopes that survive the transformAndCheckMessage validation gate; malformed or invalid messages are rejected before goroutine spawn. Exploitation is limited to nodes running Klever-Go versions 1.7.14-1.7.17; nodes upgraded to v1.7.18 are not affected. There is no requirement for the attacker to hold stake, validator status, or any existing relationship with the node. The primary limiting factor for exploitation at scale is that the attacker must be network-adjacent to each target node individually, as the impact radius per attack is a single node rather than a broadcast mechanism.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yields a score of 7.5 (High), and the vector is well-calibrated: exploitation requires only network reachability and the ability to send well-formed libp2p messages - no credentials, no prior relationship, no user interaction. Practically, any peer that can reach the node's P2P port and complete a libp2p handshake qualifies, which in a public blockchain network is a trivially low bar. The impact is constrained to availability (A:H), with no confidentiality or integrity exposure, which keeps this from reaching Critical. No EPSS data was supplied and this CVE does not appear in the CISA KEV catalog, meaning there is no confirmed evidence of active in-the-wild exploitation; however, the GHSA advisory published full source-code context including the exact vulnerable function and file:line reference, which effectively serves as exploitation documentation. The blockchain node availability impact carries systemic weight beyond a single operator: if enough validators are taken offline simultaneously, the risk extends to network liveness. Real-world priority should be rated high for Klever node operators, particularly given a same-day patch is available with no behavioral changes.

An attacker running a standard libp2p client connects to a vulnerable Klever node as a peer and opens a DirectSendID stream. The attacker then sends a continuous high-rate stream of well-formed TopicMessage envelopes with varying sequence numbers - legitimate-looking messages that pass the transformAndCheckMessage gate - causing the node to spawn thousands of goroutines before any antiflood logic can intervene. The goroutine pool exhausts available memory and saturates the Go scheduler, causing the node to become unresponsive to legitimate validator traffic. No exploit binary is publicly known, but the GHSA advisory provides exact file, line number, and source code walkthrough, substantially reducing the effort required to develop one.