CVE-2026-44697: Klever-Go Remote Denial-of-Service via Decompression Bomb

Technical summary

The vulnerability resides in Batch.Decompress within data/batch/batch.go and is triggered when a node receives a gossip message on a topic served by MultiDataInterceptor. The decompression logic fails to validate or bound the output size of decompressed data, allowing an attacker to craft a payload that expands from sub-50 KiB input to multi-gigabyte heap allocations. This represents a classic zip-bomb or decompression bomb attack vector. The flaw is categorized as an improper resource allocation issue (CWE-409) combined with uncontrolled resource consumption (CWE-770). Because the Klever protocol uses gossip-based message propagation, any peer—including malicious or compromised ones—can inject the malicious payload to any listening node.

Business impact

For Klever network operators and validators, this vulnerability creates immediate operational risk. A single attacker can selectively target and crash individual validator nodes, degrading network throughput or triggering consensus failures if enough validators are affected. In a coordinated attack, an adversary could destabilize chain liveness, preventing block production and transaction finality. This is particularly severe for networks where validator count is modest or geographically concentrated. Organizations running Klever infrastructure face potential service interruptions, missed block rewards, and reputational damage. The attack surface is broad: any node accepting gossip messages is vulnerable, making network-wide mitigation difficult without patching.

Affected systems

Klever-Go prior to version 1.7.17 is affected. This includes all validator and full-node deployments running vulnerable versions. Any infrastructure dependent on Klever consensus or data availability is in scope. Environments with standard memory provisioning (e.g., 4–32 GB per node) are particularly exposed, as a single malicious payload can exhaust available heap and trigger OOM-kill. Testnet, stagenet, and mainnet deployments are equally vulnerable.

Exploitability

Exploitability is very high. The attack is trivial to execute: craft a sub-50 KiB payload with a decompression bomb pattern and broadcast it to the Klever gossip network. No authentication, credentials, or privileged network access is required. Any peer connected to the network can send the payload. A single packet is sufficient to crash a target node. The barrier to weaponization is negligible, and no specialized tools are needed. The impact is immediate and deterministic.

Remediation

Upgrade Klever-Go to version 1.7.17 or later. This version contains a fix that properly validates or bounds decompressed data size, preventing unbounded heap allocation. Operators should prioritize this upgrade as critical. Before upgrading, consider temporary mitigations such as adjusting ulimits to constrain per-process memory, implementing ingress-level gossip filtering (if feasible), or temporarily isolating nodes from untrusted peers—though these do not address the root cause.

Patch guidance

Review your Klever-Go deployment version immediately. If running 1.7.16 or earlier, schedule an urgent upgrade to 1.7.17. Verify the patch version against official Klever release notes and checksums to ensure authenticity. For large deployments, coordinate a rolling upgrade strategy to maintain network stability during the transition. Test the upgrade in a staging environment first, particularly if you run custom configurations or integrations. After patching, monitor node memory usage and crash logs to confirm the issue is resolved.

Detection guidance

Monitor validator and node memory consumption for sudden spikes or out-of-memory events. Enable verbose logging in Batch.Decompress or the gossip layer to detect unusual decompression patterns or oversized payloads. Network-level detection is challenging without deep packet inspection, but anomalous gossip message sizes or patterns from specific peers may warrant investigation. Correlate node crashes with timestamp-aligned gossip traffic to identify potential attack sources. Post-upgrade, such spikes should no longer occur; their presence indicates an unpatched or compromised node.

Why prioritize this

This vulnerability merits immediate patching because it enables trivial, network-wide denial-of-service of blockchain consensus infrastructure. The combination of ease of exploitation (no authentication, single packet), high impact (node crash, chain liveness loss), and broad attack surface (any gossip peer) makes it a critical risk. The CVSS 8.6 HIGH score reflects the severity. Operators of Klever validators and full nodes should treat this as P0 or P1 depending on their infrastructure SLA.

Risk score, explained

CVSS 3.1 score of 8.6 (HIGH) is driven by network-adjacent attack vector (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), no user interaction (UI:N), and scope change (S:C) reflecting impact to network-wide consensus. The scoring emphasizes high availability impact (A:H) with no confidentiality or integrity loss. The score appropriately captures the operational severity while acknowledging that direct data breach or system compromise is not the threat model here.

Frequently asked questions