CVE-2026-44697: Klever-io Klever-Go denial of service via decompression bomb

Executive brief

A vulnerability in the Klever-Go blockchain software allows a remote attacker to crash network nodes by sending a specially crafted, small compressed message. This "decompression bomb" forces the receiving node to consume massive amounts of memory, leading to a denial-of-service. This can disrupt the entire blockchain network's ability to process transactions and maintain operations.

Technical details

The vulnerability exists in the `Batch.Decompress` function within `data/batch/batch.go`. The `decompressGzip` helper performs an unbounded `io.ReadAll` on a gzip reader without using a `LimitReader` or validating the `DataSize` field. Because the `MultiDataInterceptor` processes decompression before performing count-based anti-flood checks, a sub-50 KiB payload can trigger multi-gigabyte heap allocations. An attacker can exploit this to OOM-kill validators on the P2P network. The issue is tracked as CVE-2026-44697 and is remediated by implementing a hard ceiling on inflated batch sizes and validating decompressed lengths.

Affected products

• klever-io klever-go <= 1.7.16

Timeline

• 2026-05-11: advisory: GitHub Advisory published
• 2026-05-13: disclosed: CVE-2026-44697 disclosed

References

• https://api.github.com/users/fbsobreira
• https://github.com/fbsobreira
• https://api.github.com/users/fbsobreira/gists%7B/gist_id%7D
• https://api.github.com/users/fbsobreira/repos
• https://avatars.githubusercontent.com/u/8503176?v=4
• https://api.github.com/users/fbsobreira/events%7B/privacy%7D