CVE Watchtower


← Back to CVE List

CVE-2026-44697NVD

Vulnerability Summary

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.17, a remote, unauthenticated denial-of-service vulnerability in Batch.Decompress (data/batch/batch.go) allows any peer that participates in a topic served by MultiDataInterceptor to allocate multi-gigabyte heaps on the receiving node from a sub-50 KiB gossip payload. A single packet is sufficient to OOM-kill a validator with conventional memory provisioning. Fleet-wide application affects chain liveness. This vulnerability is fixed in 1.7.17.
Severity Level
HIGH(8.6)
Published Date
May 29, 2026
Last Modified
Jun 2, 2026
Exploitation Status
UNKNOWN
Root Weakness (CWE)
Refer to the official MITRE database for detailed architectural specifications regarding this weakness.
EPSS Score (30-Day)
0.05%Probability
CVSS v3.1 Base Metrics
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeChanged
ConfidentialityNone
IntegrityNone
AvailabilityHigh