Security
فارسی
All products

github.com/klever-io/klever-go

Go · Package
18 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated callerCVE-2026-82405 · GHSA-97CV-X867-6XHMVersion ranges need review. github.com/klever-io/klever-go Go High Fix reported
Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplaceCVE-2026-82406 · GHSA-26R5-4MM2-PX5CVersion ranges need review. github.com/klever-io/klever-go Go High Fix reported
Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoSCVE-2026-82407 · GHSA-9WH6-9HQ7-9688Version ranges need review. github.com/klever-io/klever-go Go High Fix reported
Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgeryCVE-2026-82409 · GHSA-7C7C-373R-GFJJVersion ranges need review. github.com/klever-io/klever-go Go High Fix reported
Klever-Go: /log controls global node loggingCVE-2026-86064 · GHSA-9V8P-FRVJ-2PCMVersion ranges need review. github.com/klever-io/klever-go Go High Fix reported
Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS)CVE-2026-86065 · GHSA-4FWH-WRM6-97XMVersion ranges need review. github.com/klever-io/klever-go Go High Fix reported
Klever: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token)CVE-2026-54755 · GHSA-CGC5-V3F2-8M2VVersion ranges need review. github.com/klever-io/klever-go Go Critical Fix reported
klever-go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupplyCVE-2026-55764 · GHSA-MRPP-V6PG-P54XVersion ranges need review. github.com/klever-io/klever-go Go High Fix reported
Klever: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped)CVE-2026-54754 · GHSA-P7GW-2PCP-5PF8Version ranges need review. github.com/klever-io/klever-go Go Critical Fix reported
klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splitsCVE-2026-55763 · GHSA-V358-WF77-39XVVersion ranges need review. github.com/klever-io/klever-go Go High Fix reported
Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payloadCVE-2026-44697 · GHSA-87M7-QFFR-542VVersion ranges need review. github.com/klever-io/klever-go Go High No fix reported
klever-go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoSCVE-2026-52879 · GHSA-HF2G-6J7H-98WGVersion ranges need review. github.com/klever-io/klever-go Go High Fix reported
Klever-Go KVM: Unauthenticated remote node crash (nil-pointer DoS) in klever-go P2P transaction interceptor (txVersionChecker nil RawData) - potential chain haltCVE-2026-52878 · GHSA-RM5C-5X2P-48WRVersion ranges need review. github.com/klever-io/klever-go Go High Fix reported
klever-go: REST API slow-header connection exhaustion via Gin Engine.RunCVE-2026-52880 · GHSA-W4C6-7R69-W7J9Version ranges need review. github.com/klever-io/klever-go Go High Fix reported
Klever-Go KVM read-only execution can commit contract delete and upgrade side effectsCVE-2026-46403 · GHSA-JC6W-WMFC-FH33Version ranges need review. github.com/klever-io/klever-go Go Medium Fix reported
Klever-Go KVM: Hash-array amplification in P2P resolver request handlingCVE-2026-47249 · GHSA-W342-MJ6G-V9C4Version ranges need review. github.com/klever-io/klever-go Go High Fix reported
Klever-Go P2P MultiDataInterceptor leaks global throttler slots on malformed compressed batches (DoS)GHSA-74M6-4HJP-7226 · GO-2026-5204Version ranges need review. github.com/klever-io/klever-go Go High Fix reported
Klever-Go KVM: Throttler slot leak in trie account-data sync causes epoch bootstrap / state sync DoSCVE-2026-49343 · GHSA-FW38-PC54-JVX9Version ranges need review. github.com/klever-io/klever-go Go Medium Fix reported