Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/klever-io/klever-go

17 known vulnerabilities (2 critical, 13 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release
v1.7.22 (Oct 19, 2026): affected by 2 advisories
Newest unaffected release
Every release is affected by at least one advisory
Advisories
17 · 2 critical, 13 high, 2 medium
Releases
14 since v1.7.14 (Sep 26, 2025)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

Show all 17 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 17

  • Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated caller

    Affected: fixed in 1.7.20.

    Fixed in v1.7.20 (released Jul 16, 2026, 69 days before disclosure).

    The latest release, v1.7.22, is not affected.

  • Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery

    Affected: fixed in 1.7.20.

    Fixed in v1.7.20 (released Jul 16, 2026, 69 days before disclosure).

    The latest release, v1.7.22, is not affected.

  • Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS

    Affected: fixed in 1.7.20.

    Fixed in v1.7.20 (released Jul 16, 2026, 69 days before disclosure).

    The latest release, v1.7.22, is not affected.

  • Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS)

    Affected: fixed in 1.7.20.

    Fixed in v1.7.20 (released Jul 16, 2026, 69 days before disclosure).

    The latest release, v1.7.22, is not affected.

  • Klever-Go: /log controls global node logging

    Affected: fixed in 1.7.20.

    Fixed in v1.7.20 (released Jul 16, 2026, 69 days before disclosure).

    The latest release, v1.7.22, is not affected.

  • Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace

    Affected: fixed in 1.7.20.

    Fixed in v1.7.20 (released Jul 16, 2026, 69 days before disclosure).

    The latest release, v1.7.22, is not affected.

  • Klever-Go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply

    Affected: fixed in 1.7.19.

    Fixed in v1.7.19 (released Jun 22, 2026, 67 days before disclosure).

    The latest release, v1.7.22, is not affected.

  • Klever-Go: Percentage-transfer royalty skips the source debit at exactly-100% splits

    Affected: all versions; fixed in 1.7.19-rc4.

    No fix released. The latest release, v1.7.22, is still affected.

  • CVE-2026-54755Critical 9.6

    Klever-Go: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token)

    Affected: fixed in 1.7.19.

    Fixed in v1.7.19 (released Jun 22, 2026, 67 days before disclosure).

    The latest release, v1.7.22, is not affected.

  • CVE-2026-54754Critical 9.6

    Klever-Go: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped)

    Affected: fixed in 1.7.19.

    Fixed in v1.7.19 (released Jun 22, 2026, 67 days before disclosure).

    The latest release, v1.7.22, is not affected.

  • Klever-Go: REST API slow-header connection exhaustion via Gin Engine.Run

    Affected: from 1.7.14, fixed in 1.7.18.

    Fixed in v1.7.18 (released Jun 1, 2026, 67 days before disclosure).

    The latest release, v1.7.22, is not affected.

  • Klever-Go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoS

    Affected: from 1.7.14, fixed in 1.7.18.

    Fixed in v1.7.18 (released Jun 1, 2026, 67 days before disclosure).

    The latest release, v1.7.22, is not affected.

  • Klever-Go: Unauthenticated nil-pointer DoS in P2P transaction validation can halt the chain

    Affected: from 1.7.14, fixed in 1.7.18.

    Fixed in v1.7.18 (released Jun 1, 2026, 67 days before disclosure).

    The latest release, v1.7.22, is not affected.

  • CVE-2026-49343Medium 5.9

    Klever-Go KVM: Throttler slot leak in trie account-data sync causes epoch bootstrap / state sync DoS

    Affected: fixed in 1.7.18.

    Fixed in v1.7.18 (released Jun 1, 2026, 67 days before disclosure).

    The latest release, v1.7.22, is not affected.

  • Klever-Go KVM: Hash-array amplification in P2P resolver request handling

    Affected: fixed in 1.7.18.

    Fixed in v1.7.18 (released Jun 1, 2026, 67 days before disclosure).

    The latest release, v1.7.22, is not affected.

Show all 17 advisoriesShow fewer advisories
  • CVE-2026-46403Medium 6.3

    Klever-Go KVM read-only execution can commit contract delete and upgrade side effects

    Affected: fixed in 1.7.17.

    Fixed in v1.7.17 (released May 11, 2026, 71 days before disclosure).

    The latest release, v1.7.22, is not affected.

  • Klever-Go MultiDataInterceptor: remote OOM via crafted compressed P2P payload

    Affected: all versions; through 1.7.16.

    No fix released. The latest release, v1.7.22, is still affected.