Klever‑Go, the Go implementation of the Klever blockchain protocol, contains an unauthenticated denial‑of‑service flaw in its Batch.Decompress function. By sending a small (sub‑50 KiB) gossip packet that is compressed for the MultiDataInterceptor, an attacker can cause the receiving node to allocate multi‑gigabyte heap memory, leading to an out‑of‑memory (OOM) crash. The high CVSS score of 8.6 reflects the severity of the impact, depriving validators of processing capacity and destabilising chain liveness.

The vulnerability affects all Klever‑io Klever‑Go deployments running any version prior to 1.7.17. Any validator or node that accepts gossip traffic on a topic served by the MultiDataInterceptor is susceptible, regardless of the node’s role within the network.

The CVSS score indicates a high‑severity weakness, but the EPSS score is unavailable, so the likelihood of exploitation in the wild is indeterminate. The flaw is listed as not part of the CISA KEV catalog. Attackers can trigger the issue remotely, without authentication, by injecting a crafted packet over the gossip network; therefore any node exposed to untrusted peers is a potential target.