# CVE-2026-44697: Klever-io Klever-Go denial of service via decompression bomb

Source: https://junglewise.ai/threats/cve-2026-44697-klever-io-klever-go-denial-of-service-via-decompression-bomb  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-29. Updated: 2026-05-29  
License: CC BY 4.0 with a link back

CVE-2026-44697 · Severity: high · CVSS 8.6 · Published 2026-05-29

A vulnerability in the Klever-Go blockchain software allows a remote attacker to crash network nodes by sending a specially crafted, small compressed message. This "decompression bomb" forces the receiving node to consume massive amounts of memory, leading to a denial-of-service. This can disrupt the entire blockchain network's ability to process transactions and maintain operations.

Technologies: [github.com/klever-io/klever-go (Go)](https://junglewise.ai/threats/technologies/github-com-klever-io-klever-go), [Klever Go SDK](https://junglewise.ai/threats/technologies/klever-go-sdk), [Klever.io Klever-Go](https://junglewise.ai/threats/technologies/klever-go). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Klever](https://junglewise.ai/threats/vendors/klever), [Klever.io](https://junglewise.ai/threats/vendors/klever-io).

## Quick answers

**Is CVE-2026-44697 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44697 being exploited in the wild.

**How severe is CVE-2026-44697?** High severity, with a CVSS score of 8.6, published 29 May 2026.

**Which products and versions are affected?** github.com/klever-io/klever-go (Go) <= 1.7.16, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.7.16; Klever Go SDK <= 1.7.16; Klever.io Klever-Go < 1.7.17.

**Is there a fix for CVE-2026-44697?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-44697 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44697?** Check whether you run github.com/klever-io/klever-go (Go), Klever Go SDK or Klever.io Klever-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the `Batch.Decompress` function within `data/batch/batch.go`. The `decompressGzip` helper performs an unbounded `io.ReadAll` on a gzip reader without using a `LimitReader` or validating the `DataSize` field. Because the `MultiDataInterceptor` processes decompression before performing count-based anti-flood checks, a sub-50 KiB payload can trigger multi-gigabyte heap allocations. An attacker can exploit this to OOM-kill validators on the P2P network. The issue is tracked as CVE-2026-44697 and is remediated by implementing a hard ceiling on inflated batch sizes and validating decompressed lengths.

## Affected products

- klever-io klever-go <= 1.7.16

## Identifiers

- CVE-2026-44697
- GHSA-87m7-qffr-542v
- GO-2026-5246

## Timeline

- 2026-05-11: advisory: GitHub Advisory published
- 2026-05-13: disclosed: CVE-2026-44697 disclosed

## References

- [https://api.github.com/users/fbsobreira](https://api.github.com/users/fbsobreira)
- [https://github.com/fbsobreira](https://github.com/fbsobreira)
- [https://api.github.com/users/fbsobreira/gists%7B/gist_id%7D](https://api.github.com/users/fbsobreira/gists%7B/gist_id%7D)
- [https://api.github.com/users/fbsobreira/repos](https://api.github.com/users/fbsobreira/repos)
- [https://avatars.githubusercontent.com/u/8503176?v=4](https://avatars.githubusercontent.com/u/8503176?v=4)
- [https://api.github.com/users/fbsobreira/events%7B/privacy%7D](https://api.github.com/users/fbsobreira/events%7B/privacy%7D)

## Related threats

- [Klever-Go unauthenticated WebSocket /subscribe remote DoS](https://junglewise.ai/threats/cve-2026-86065-klever-go-unauthenticated-websocket-subscribe-remote-dos)
- [Klever-Go /log endpoint unauthenticated logging configuration manipulation](https://junglewise.ai/threats/cve-2026-86064-klever-go-log-endpoint-unauthenticated-logging-configuration)
- [Klever-Go Elasticsearch injection via account name](https://junglewise.ai/threats/cve-2026-82409-klever-go-elasticsearch-injection-via-account-name)
- [Klever-Go BLS public key validation bypass in validator registration](https://junglewise.ai/threats/cve-2026-82407-klever-go-bls-public-key-validation-bypass-in-validator)
- [Klever-Go marketplace Buy missing IsClaimed guard](https://junglewise.ai/threats/cve-2026-82406-klever-go-marketplace-buy-missing-isclaimed-guard)