Klever‑Go, the Go implementation of the Klever blockchain protocol, suffers from a nil‑pointer dereference when a protobuf transaction omits its embedded RawData sub‑message. The missing RawData field decodes to nil, causing the validator to dereference tx.RawData.Version without guarding against nil, which triggers a panic. This panic propagates through the libp2p pubsub validation worker and ultimately crashes the entire node process, halting block production on affected nodes. The vulnerability can be exploited by an unauthenticated attacker who can craft a simple 3‑byte protobuf message. Inference from the description indicates that the attacker does not need validator credentials or on‑chain funds; delivery to enough members of the BLS validator set is sufficient to disrupt the chain. This leads to a global denial of service when the network can no longer produce blocks. Although the EPSS score is not provided, the lack of authentication, the low payload size, and the ability to reach any node across the P2P network together suggest that exploitation is straightforward. The CVSS score of 7.5 reflects a high impact denial of service while the KEV status is not listed.

Klever‑Go from Klever‑IO version 1.7.14 through 1.7.17 are vulnerable. Any node running these versions that participates in the P2P network is susceptible until it is upgraded to the fixed release 1.7.18.

The risk is elevated by the high CVSS and by the fact that the attack requires only a small malicious payload that can be sent from any network point capable of reaching a node. The vulnerability is not listed in the CISA KEV catalog, but the severity combined with the lack of mitigation means that any exposed node could be taken offline by an unauthenticated adversary.