These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-86065 is a high-severity vulnerability in the Klever-Go implementation of the Klever blockchain protocol. The vulnerability affects the default-open GET /subscribe endpoint in network/api/websocket/routes.go, which accepts unauthenticated WebSocket clients with permissive origin handling. This allows for potential memory or scheduler exhaustion, which can crash the node and interrupt P2P and cons [truncated]
A remotely triggerable denial of service vulnerability exists in Klever-Go versions from 1.7.14 through 1.7.17. The REST APIs are started with the Gin Engine.Run convenience method, which serves requests through Go's default HTTP server with no ReadHeaderTimeout, ReadTimeout, or MaxHeaderBytes configured. This allows incoming connections that never complete their request headers to be held open indefinite [truncated]
A vulnerability in Klever-Go, the Go implementation of the Klever blockchain protocol, allows for a remotely triggerable denial of service. The issue, fixed in version 1.7.18, involves the direct-message ingress handler spawning a new goroutine for every incoming direct message without proper admission control, leading to unbounded goroutine creation and increased scheduler and garbage-collection pressure.
A vulnerability in Klever-Go, a Go implementation of the Klever blockchain protocol, allows for a nil-pointer panic triggered by a specially crafted protobuf Transaction. This issue, present in versions 1.7.14 through 1.7.17, can cause a node process crash, potentially halting block production and resulting in a chain halt. The vulnerability has been fixed in version 1.7.18.
CVE-2026-49343 debrief: Klever-Go resource-exhaustion flaw affects nodes and validators. The vulnerability is caused by a flaw in the account-data trie syncers that leaks bounded throttler slots on error paths, which can cause bootstrap to fail and affect fresh, restarting, or resyncing nodes and validators. Defenders should prioritize verifying exposure and assessing remediation for Klever-Go versions pr [truncated]
CVE-2026-47249 is a high-severity vulnerability in the Klever-Go implementation of the Klever blockchain protocol. A remote attacker can exploit this vulnerability by sending a specially crafted request that can cause memory and CPU amplification, potentially leading to a denial-of-service (DoS) attack. The vulnerability is fixed in version 1.7.18.
CVE-2026-58262 is a high-severity vulnerability in the Klever-Go implementation of the Klever blockchain protocol. The issue allows a malicious block producer to manipulate header signature verification, potentially weakening consensus safety and undermining finality. This vulnerability was published on 2026-08-07T22:16:59.327Z and last modified on 2026-09-09T20:55:04.493Z.
A vulnerability was discovered in Klever-Go's KVM implementation, exposing a read-only execution mechanism that could be exploited to delete contracts. The issue was caused by the indirect contract delete and upgrade paths not rejecting execution when in read-only mode. The fix was introduced in version 1.7.17. This vulnerability impacts users of Klever-Go, particularly those relying on read-only calls to [truncated]
A remote, unauthenticated denial-of-service vulnerability exists in Klever-Go prior to version 1.7.17. The flaw resides in the `Batch.Decompress` function within `data/batch/batch.go`, where an attacker can trigger multi-gigabyte heap allocations on a receiving node by sending a crafted gossip payload of less than 50 KiB. A single malicious packet is sufficient to cause an out-of-memory (OOM) termination [truncated]