Go/github.com/klever-io/klever-go

Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace

Modified: 10/1/2026

Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS)

Modified: 10/1/2026

Klever-Go P2P MultiDataInterceptor leaks global throttler slots on malformed compressed batches (DoS)

Modified: 6/25/2026

Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery

Modified: 10/1/2026

Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payload

Modified: 7/21/2026

Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated caller

Modified: 10/1/2026

Klever-Go: /log controls global node logging

Modified: 10/1/2026

Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS

Modified: 10/1/2026

Klever: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token)

Modified: 9/2/2026

Klever-Go KVM: Throttler slot leak in trie account-data sync causes epoch bootstrap / state sync DoS

Modified: 6/25/2026

klever-go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoS

Modified: 6/25/2026

Klever-Go KVM read-only execution can commit contract delete and upgrade side effects

Modified: 6/25/2026

klever-go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply

Modified: 9/2/2026

Klever: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped)

Modified: 9/2/2026

Klever-Go KVM: Unauthenticated remote node crash (nil-pointer DoS) in klever-go P2P transaction interceptor (txVersionChecker nil RawData) - potential chain halt

Modified: 6/25/2026

klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits

Modified: 9/2/2026

Klever-Go KVM: Hash-array amplification in P2P resolver request handling

Modified: 6/25/2026

klever-go: REST API slow-header connection exhaustion via Gin Engine.Run

Modified: 6/25/2026

Klever-Go P2P MultiDataInterceptor leaks global throttler slots on malformed compressed batches (DoS) in github.com/klever-io/klever-go

Modified: 6/25/2026

Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payload in github.com/klever-io/klever-go

Modified: 6/25/2026

Klever-Go KVM: Throttler slot leak in trie account-data sync causes epoch bootstrap / state sync DoS in github.com/klever-io/klever-go

Modified: 6/25/2026

klever-go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoS in github.com/klever-io/klever-go

Modified: 6/25/2026

Klever-Go KVM read-only execution can commit contract delete and upgrade side effects in github.com/klever-io/klever-go

Modified: 6/25/2026

Klever-Go KVM: Unauthenticated remote node crash (nil-pointer DoS) in klever-go P2P transaction interceptor (txVersionChecker nil RawData) - potential chain halt in github.com/klever-io/klever-go

Modified: 6/25/2026

Klever-Go KVM: Hash-array amplification in P2P resolver request handling in github.com/klever-io/klever-go

Modified: 6/25/2026

klever-go: REST API slow-header connection exhaustion via Gin Engine.Run in github.com/klever-io/klever-go

Modified: 6/25/2026

Klever: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token) in github.com/klever-io/klever-go

Modified: 9/2/2026

Klever: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped) in github.com/klever-io/klever-go

Modified: 9/2/2026

klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits in github.com/klever-io/klever-go

Modified: 9/2/2026

klever-go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply in github.com/klever-io/klever-go

Modified: 9/2/2026

Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS) in github.com/klever-io/klever-go

Modified: 10/1/2026

Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated caller in github.com/klever-io/klever-go

Modified: 10/1/2026

Klever-Go: /log controls global node logging in github.com/klever-io/klever-go

Modified: 10/1/2026

Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace in github.com/klever-io/klever-go

Modified: 10/1/2026

Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery in github.com/klever-io/klever-go

Modified: 10/1/2026

Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS in github.com/klever-io/klever-go

Modified: 10/1/2026