# github.com/klever-io/klever-go (Go) vulnerabilities 17 known vulnerabilities (2 critical, 13 high, 2 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v1.7.22 (Oct 19, 2026): affected by 2 advisories - Newest unaffected release: Every release is affected by at least one advisory - Releases: 14 since v1.7.14 (Sep 26, 2025) - Registry: https://pkg.go.dev/github.com/klever-io/klever-go - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-82405: v1.7.14 to v1.7.19 (v1.7.20 is outside it) - CVE-2026-82409: v1.7.14 to v1.7.19 (v1.7.20 is outside it) - CVE-2026-82407: v1.7.14 to v1.7.19 (v1.7.20 is outside it) - CVE-2026-86065: v1.7.14 to v1.7.19 (v1.7.20 is outside it) - CVE-2026-86064: v1.7.14 to v1.7.19 (v1.7.20 is outside it) - CVE-2026-82406: v1.7.14 to v1.7.19 (v1.7.20 is outside it) - CVE-2026-55764: v1.7.14 to v1.7.18 (v1.7.19 is outside it) - CVE-2026-55763: v1.7.14 to v1.7.22 (through the newest release) - CVE-2026-54755: v1.7.14 to v1.7.18 (v1.7.19 is outside it) - CVE-2026-54754: v1.7.14 to v1.7.18 (v1.7.19 is outside it) - CVE-2026-52880: v1.7.14 to v1.7.17 (v1.7.18 is outside it) - CVE-2026-52879: v1.7.14 to v1.7.17 (v1.7.18 is outside it) - CVE-2026-52878: v1.7.14 to v1.7.17 (v1.7.18 is outside it) - CVE-2026-49343: v1.7.14 to v1.7.17 (v1.7.18 is outside it) - CVE-2026-47249: v1.7.14 to v1.7.17 (v1.7.18 is outside it) - CVE-2026-46403: v1.7.14 to v1.7.16 (v1.7.17 is outside it) - CVE-2026-44697: v1.7.14 to v1.7.22 (through the newest release) ## Advisories (17) ### [CVE-2026-82405](https://cve.now/CVE-2026-82405): Klever-Go Account takeover: \`kleverUpdateAccountPermission\` authorizes on attacker-controlled \`RecipientAddr\` instead of the authenticated caller - Severity: High 8.7 - Published: Sep 23, 2026 - Affected: fixed in 1.7.20. - Fixed in v1.7.20 (released Jul 16, 2026, 69 days before disclosure). - The latest release, v1.7.22, is not affected. ### [CVE-2026-82409](https://cve.now/CVE-2026-82409): Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -\> explorer/indexer data forgery - Severity: High 8.4 - Published: Sep 23, 2026 - Affected: fixed in 1.7.20. - Fixed in v1.7.20 (released Jul 16, 2026, 69 days before disclosure). - The latest release, v1.7.22, is not affected. ### [CVE-2026-82407](https://cve.now/CVE-2026-82407): Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS - Severity: High 7.0 - Published: Sep 23, 2026 - Affected: fixed in 1.7.20. - Fixed in v1.7.20 (released Jul 16, 2026, 69 days before disclosure). - The latest release, v1.7.22, is not affected. ### [CVE-2026-86065](https://cve.now/CVE-2026-86065): Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -\> remote node memory/goroutine exhaustion (DoS) - Severity: High 7.5 - Published: Sep 23, 2026 - Affected: fixed in 1.7.20. - Fixed in v1.7.20 (released Jul 16, 2026, 69 days before disclosure). - The latest release, v1.7.22, is not affected. ### [CVE-2026-86064](https://cve.now/CVE-2026-86064): Klever-Go: /log controls global node logging - Severity: High 8.6 - Published: Sep 23, 2026 - Affected: fixed in 1.7.20. - Fixed in v1.7.20 (released Jul 16, 2026, 69 days before disclosure). - The latest release, v1.7.22, is not affected. ### [CVE-2026-82406](https://cve.now/CVE-2026-82406): Klever-Go: Zombie-order theft: \`Buy\` missing \`IsClaimed\` guard in native marketplace - Severity: High 7.1 - Published: Sep 23, 2026 - Affected: fixed in 1.7.20. - Fixed in v1.7.20 (released Jul 16, 2026, 69 days before disclosure). - The latest release, v1.7.22, is not affected. ### [CVE-2026-55764](https://cve.now/CVE-2026-55764): Klever-Go: SFT add-quantity \`int64\` overflow bypasses a finite per-nonce MaxSupply - Severity: High 8.7 - Published: Aug 28, 2026 - Affected: fixed in 1.7.19. - Fixed in v1.7.19 (released Jun 22, 2026, 67 days before disclosure). - The latest release, v1.7.22, is not affected. ### [CVE-2026-55763](https://cve.now/CVE-2026-55763): Klever-Go: Percentage-transfer royalty skips the source debit at exactly-100% splits - Severity: High 8.7 - Published: Aug 28, 2026 - Affected: all versions; fixed in 1.7.19-rc4. - No fix released. The latest release, v1.7.22, is still affected. ### [CVE-2026-54755](https://cve.now/CVE-2026-54755): Klever-Go: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token) - Severity: Critical 9.6 - Published: Aug 28, 2026 - Affected: fixed in 1.7.19. - Fixed in v1.7.19 (released Jun 22, 2026, 67 days before disclosure). - The latest release, v1.7.22, is not affected. ### [CVE-2026-54754](https://cve.now/CVE-2026-54754): Klever-Go: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped) - Severity: Critical 9.6 - Published: Aug 28, 2026 - Affected: fixed in 1.7.19. - Fixed in v1.7.19 (released Jun 22, 2026, 67 days before disclosure). - The latest release, v1.7.22, is not affected. ### [CVE-2026-52880](https://cve.now/CVE-2026-52880): Klever-Go: REST API slow-header connection exhaustion via Gin Engine.Run - Severity: High 7.5 - Published: Aug 7, 2026 - Affected: from 1.7.14, fixed in 1.7.18. - Fixed in v1.7.18 (released Jun 1, 2026, 67 days before disclosure). - The latest release, v1.7.22, is not affected. ### [CVE-2026-52879](https://cve.now/CVE-2026-52879): Klever-Go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoS - Severity: High 7.5 - Published: Aug 7, 2026 - Affected: from 1.7.14, fixed in 1.7.18. - Fixed in v1.7.18 (released Jun 1, 2026, 67 days before disclosure). - The latest release, v1.7.22, is not affected. ### [CVE-2026-52878](https://cve.now/CVE-2026-52878): Klever-Go: Unauthenticated nil-pointer DoS in P2P transaction validation can halt the chain - Severity: High 7.5 - Published: Aug 7, 2026 - Affected: from 1.7.14, fixed in 1.7.18. - Fixed in v1.7.18 (released Jun 1, 2026, 67 days before disclosure). - The latest release, v1.7.22, is not affected. ### [CVE-2026-49343](https://cve.now/CVE-2026-49343): Klever-Go KVM: Throttler slot leak in trie account-data sync causes epoch bootstrap / state sync DoS - Severity: Medium 5.9 - Published: Aug 7, 2026 - Affected: fixed in 1.7.18. - Fixed in v1.7.18 (released Jun 1, 2026, 67 days before disclosure). - The latest release, v1.7.22, is not affected. ### [CVE-2026-47249](https://cve.now/CVE-2026-47249): Klever-Go KVM: Hash-array amplification in P2P resolver request handling - Severity: High 7.5 - Published: Aug 7, 2026 - Affected: fixed in 1.7.18. - Fixed in v1.7.18 (released Jun 1, 2026, 67 days before disclosure). - The latest release, v1.7.22, is not affected. ### [CVE-2026-46403](https://cve.now/CVE-2026-46403): Klever-Go KVM read-only execution can commit contract delete and upgrade side effects - Severity: Medium 6.3 - Published: Jul 21, 2026 - Affected: fixed in 1.7.17. - Fixed in v1.7.17 (released May 11, 2026, 71 days before disclosure). - The latest release, v1.7.22, is not affected. ### [CVE-2026-44697](https://cve.now/CVE-2026-44697): Klever-Go MultiDataInterceptor: remote OOM via crafted compressed P2P payload - Severity: High 8.6 - Published: May 29, 2026 - Affected: all versions; through 1.7.16. - No fix released. The latest release, v1.7.22, is still affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/github.com/klever-io/klever-go Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.