CVE-2026-52878

Name of the Vulnerable Software and Affected Versions Klever-Go versions 1.7.14 through 1.7.17

Description A nil-pointer panic can be triggered by a protobuf Transaction where the embedded RawData sub-message is omitted, causing RawData to decode to nil. During the decoding and validation of transactions gossiped on the P2P network, the txVersionChecker.CheckTxVersion() function dereferences tx.RawData.Version without a nil check. Since the libp2p pubsub callback and the network layer do not implement a recovery mechanism, the panic crashes the entire node process. An attacker can send a 3-byte protobuf message without requiring a validator key, stake, funds, or an on-chain account. If enough nodes in the BLS validator set are targeted, block production can be stopped, leading to a chain halt.

Recommendations Update Klever-Go to version 1.7.18.