Is CVE-2026-44697 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44697 being exploited in the wild.

How severe is CVE-2026-44697?

High severity, with a CVSS score of 8.6, published 29 May 2026.

Which products and versions are affected?

github.com/klever-io/klever-go (Go) <= 1.7.16, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.7.16; Klever Go SDK <= 1.7.16; Klever.io Klever-Go < 1.7.17.

Is there a fix for CVE-2026-44697?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-44697 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-44697?

Check whether you run github.com/klever-io/klever-go (Go), Klever Go SDK or Klever.io Klever-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44697: Klever-io Klever-Go denial of service via decompression bomb

Q: Is there a fix for CVE-2026-44697?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-44697 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-44697?

Check whether you run github.com/klever-io/klever-go (Go), Klever Go SDK or Klever.io Klever-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44697 · Severity: high · CVSS 8.6 · Published 2026-05-29

A vulnerability in the Klever-Go blockchain software allows a remote attacker to crash network nodes by sending a specially crafted, small compressed message. This "decompression bomb" forces the receiving node to consume massive amounts of memory, leading to a denial-of-service. This can disrupt the entire blockchain network's ability to process transactions and maintain operations.

Technologies: github.com/klever-io/klever-go (Go), Klever Go SDK, Klever.io Klever-Go. Vendors: Go, Klever, Klever.io.

Quick answers

Is CVE-2026-44697 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44697 being exploited in the wild.
How severe is CVE-2026-44697?: High severity, with a CVSS score of 8.6, published 29 May 2026.
Which products and versions are affected?: github.com/klever-io/klever-go (Go) <= 1.7.16, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.7.16; Klever Go SDK <= 1.7.16; Klever.io Klever-Go < 1.7.17.
Is there a fix for CVE-2026-44697?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-44697 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-44697?: Check whether you run github.com/klever-io/klever-go (Go), Klever Go SDK or Klever.io Klever-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the `Batch.Decompress` function within `data/batch/batch.go`. The `decompressGzip` helper performs an unbounded `io.ReadAll` on a gzip reader without using a `LimitReader` or validating the `DataSize` field. Because the `MultiDataInterceptor` processes decompression before performing count-based anti-flood checks, a sub-50 KiB payload can trigger multi-gigabyte heap allocations. An attacker can exploit this to OOM-kill validators on the P2P network. The issue is tracked as CVE-2026-44697 and is remediated by implementing a hard ceiling on inflated batch sizes and validating decompressed lengths.

Affected products

klever-io klever-go <= 1.7.16

Identifiers

CVE-2026-44697
GHSA-87m7-qffr-542v
GO-2026-5246

Timeline

2026-05-11: advisory: GitHub Advisory published
2026-05-13: disclosed: CVE-2026-44697 disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.