Klever-io Klever-Go NULL pointer dereference in P2P transaction interceptor

Executive brief

A vulnerability in the Klever-Go blockchain software allows an unauthenticated remote attacker to crash any node on the network using a specially crafted 3-byte message. This affects validators, sentries, and observers, potentially leading to a complete halt of the blockchain if enough validators are targeted. The issue stems from how the system processes peer-to-peer transaction data without proper safety checks.

Technical details

A NULL pointer dereference exists in the `txVersionChecker.CheckTxVersion` function within `core/versioning/txVersionChecker.go`. When a protobuf `Transaction` is received via the libp2p gossip network with the `RawData` field omitted, the decoder initializes `RawData` as nil. The validator subsequently attempts to dereference `tx.RawData.Version` without a nil check, triggering a panic. Because the P2P layer lacks a recovery mechanism for this synchronous callback, the panic causes the entire node process to exit. Attackers only need a self-generated libp2p identity to broadcast the 3-byte trigger message.

Affected products

• klever-io klever-go >= 1.7.14, <= 1.7.17

Timeline

• 2026-06-02: disclosed
• 2026-06-05: advisory
• 1.7.18: patched

References

• https://api.github.com/users/ch4r0utf8
• https://github.com/ch4r0utf8
• https://api.github.com/users/ch4r0utf8/gists%7B/gist_id%7D
• https://api.github.com/users/ch4r0utf8/repos
• https://avatars.githubusercontent.com/u/243903295?v=4
• https://api.github.com/users/ch4r0utf8/events%7B/privacy%7D