https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 03:24:40 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-339275 EUVD-2026-339275 https://cve.radiocsirt.org/vuln/euvd-2026-339275 https://cve.radiocsirt.org/vuln/fkie_cve-2026-44697 <p>Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.17, a remote, unauthenticated denial-of-service vulnerability in Batch.Decompress (data/batch/batch.go) allows any peer that participates in a topic served by MultiDataInterceptor to allocate multi-gigabyte heaps on the receiving node from a sub-50 KiB gossip payload. A single packet is sufficient to OOM-kill a validator with conventional memory provisioning. Fleet-wide application affects chain liveness. This vulnerability is fixed in 1.7.17.</p> <p>Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.17, a remote, unauthenticated denial-of-service vulnerability in Batch.Decompress (data/batch/batch.go) allows any peer that participates in a topic served by MultiDataInterceptor to allocate multi-gigabyte heaps on the receiving node from a sub-50 KiB gossip payload. A single packet is sufficient to OOM-kill a validator with conventional memory provisioning. Fleet-wide application affects chain liveness. This vulnerability is fixed in 1.7.17.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-44697 https://cve.radiocsirt.org/vuln/ghsa-87m7-qffr-542v <p><strong>Affected:</strong> Go: github.com/klever-io/klever-go</p> <p>## Summary</p> <p>A remote, unauthenticated denial-of-service vulnerability in `Batch.Decompress` (`data/batch/batch.go`) allows any peer that participates in a topic served by `MultiDataInterceptor` to allocate multi-gigabyte heaps on the receiving node from a sub-50 KiB gossip payload. A single packet is sufficient to OOM-kill a validator with conventional memory provisioning. Fleet-wide application affects chain liveness.</p> <p>The vulnerability was identified during an internal security review of `core/process/interceptors/multiDataInterceptor.go` at commit `405d01b0abbf0d3e73b4a990bd7394a01f200dc2`. It is distinct from, and substantially more severe than, the throttler-slot-leak vulnerability disclosed in `GHSA-74m6-4hjp-7226`. Both reports cover adjacent code in the same call path; the patches must land together in one release (rc2 superseding rc1).</p> <p>Two additional, lower-severity hardening issues affecting the same code path are documented in this report and remediated by the same patch. They are not independently exploitable under the default deployed anti-flood configuration and are not requested as separate CVEs.</p> <p>## Description</p> <p>`MultiDataInterceptor.ProcessReceivedMessage` (`core/process/interceptors/multiDataInterceptor.go:79`) handles every gossip message received on the topics the interceptor is registered for. At lines 95–102 it conditionally decompresses the payload via `Batch.Decompress`:</p> <p>```go if b.IsCompressed { err = b.Decompress(mdi.marshalizer) if err !=…</p> <p><strong>Affected:</strong> Go: github.com/klever-io/klever-go</p> <p>## Summary</p> <p>A remote, unauthenticated denial-of-service vulnerability in `Batch.Decompress` (`data/batch/batch.go`) allows any peer that participates in a topic served by `MultiDataInterceptor` to allocate multi-gigabyte heaps on the receiving node from a sub-50 KiB gossip payload. A single packet is sufficient to OOM-kill a validator with conventional memory provisioning. Fleet-wide application affects chain liveness.</p> <p>The vulnerability was identified during an internal security review of `core/process/interceptors/multiDataInterceptor.go` at commit `405d01b0abbf0d3e73b4a990bd7394a01f200dc2`. It is distinct from, and substantially more severe than, the throttler-slot-leak vulnerability disclosed in `GHSA-74m6-4hjp-7226`. Both reports cover adjacent code in the same call path; the patches must land together in one release (rc2 superseding rc1).</p> <p>Two additional, lower-severity hardening issues affecting the same code path are documented in this report and remediated by the same patch. They are not independently exploitable under the default deployed anti-flood configuration and are not requested as separate CVEs.</p> <p>## Description</p> <p>`MultiDataInterceptor.ProcessReceivedMessage` (`core/process/interceptors/multiDataInterceptor.go:79`) handles every gossip message received on the topics the interceptor is registered for. At lines 95–102 it conditionally decompresses the payload via `Batch.Decompress`:</p> <p>```go if b.IsCompressed { err = b.Decompress(mdi.marshalizer) if err !=…</p> https://cve.radiocsirt.org/vuln/ghsa-87m7-qffr-542v