github.com/klever-io/klever-go (Go)
Advisories
36
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 1.7.20 or later clears every advisory below that has a fix.
Upgrade commands
go
go get github.com/klever-io/klever-go@v1.7.20 && go mod tidyKnown vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-7c7c-373r-gfjj Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery |
High EPSS 0.34% |
< 1.7.20 | 1.7.20 |
| GHSA-7c7c-373r-gfjj Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery |
High EPSS 0.34% |
< 1.7.20 | 1.7.20 |
| GHSA-9wh6-9hq7-9688 Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS |
High EPSS 0.47% |
< 1.7.20 | 1.7.20 |
| GHSA-9wh6-9hq7-9688 Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS |
High EPSS 0.47% |
< 1.7.20 | 1.7.20 |
| GHSA-26r5-4mm2-px5c Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace |
High EPSS 0.43% |
< 1.7.20 | 1.7.20 |
| GHSA-26r5-4mm2-px5c Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace |
High EPSS 0.43% |
< 1.7.20 | 1.7.20 |
| GHSA-97cv-x867-6xhm Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated caller |
High EPSS 0.43% |
< 1.7.20 | 1.7.20 |
| GHSA-97cv-x867-6xhm Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated caller |
High EPSS 0.43% |
< 1.7.20 | 1.7.20 |
| GHSA-4fwh-wrm6-97xm Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS) |
High EPSS 0.43% |
< 1.7.20 | 1.7.20 |
| GHSA-4fwh-wrm6-97xm Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS) |
High EPSS 0.43% |
< 1.7.20 | 1.7.20 |
| GHSA-9v8p-frvj-2pcm Klever-Go: /log controls global node logging |
High EPSS 0.58% |
< 1.7.20 | 1.7.20 |
| GHSA-9v8p-frvj-2pcm Klever-Go: /log controls global node logging |
High EPSS 0.58% |
< 1.7.20 | 1.7.20 |
| GHSA-mrpp-v6pg-p54x klever-go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply |
High EPSS 0.54% |
< 1.7.19 | 1.7.19 |
| GHSA-mrpp-v6pg-p54x klever-go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply |
High EPSS 0.54% |
< 1.7.19 | 1.7.19 |
| GHSA-v358-wf77-39xv klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits |
High EPSS 0.51% |
all versions | No fix yet |
| GHSA-v358-wf77-39xv klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits |
High EPSS 0.51% |
< 1.7.19-rc4 | 1.7.19-rc4 |
| GHSA-cgc5-v3f2-8m2v Klever: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token) |
Critical EPSS 0.56% |
< 1.7.19 | 1.7.19 |
| GHSA-cgc5-v3f2-8m2v Klever: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token) |
Critical EPSS 0.56% |
< 1.7.19 | 1.7.19 |
| GHSA-p7gw-2pcp-5pf8 Klever: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped) |
Critical EPSS 0.43% |
< 1.7.19 | 1.7.19 |
| GHSA-p7gw-2pcp-5pf8 Klever: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped) |
Critical EPSS 0.43% |
< 1.7.19 | 1.7.19 |
| GHSA-rm5c-5x2p-48wr Klever-Go KVM: Unauthenticated remote node crash (nil-pointer DoS) in klever-go P2P transaction interceptor (txVersionChecker nil RawData) - potential chain halt |
High EPSS 0.49% |
>= 1.7.14, < 1.7.18 | 1.7.18 |
| GHSA-rm5c-5x2p-48wr Klever-Go KVM: Unauthenticated remote node crash (nil-pointer DoS) in klever-go P2P transaction interceptor (txVersionChecker nil RawData) - potential chain halt |
High EPSS 0.49% |
>= 1.7.14, < 1.7.18 | 1.7.18 |
| GHSA-w4c6-7r69-w7j9 klever-go: REST API slow-header connection exhaustion via Gin Engine.Run |
High EPSS 0.49% |
>= 1.7.14, < 1.7.18 | 1.7.18 |
| GHSA-w4c6-7r69-w7j9 klever-go: REST API slow-header connection exhaustion via Gin Engine.Run |
High EPSS 0.49% |
>= 1.7.14, < 1.7.18 | 1.7.18 |
| GHSA-hf2g-6j7h-98wg klever-go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoS |
High EPSS 0.49% |
>= 1.7.14, < 1.7.18 | 1.7.18 |
| GHSA-hf2g-6j7h-98wg klever-go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoS |
High EPSS 0.49% |
>= 1.7.14, < 1.7.18 | 1.7.18 |
| GHSA-fw38-pc54-jvx9 Klever-Go KVM: Throttler slot leak in trie account-data sync causes epoch bootstrap / state sync DoS |
Medium EPSS 0.41% |
< 1.7.18 | 1.7.18 |
| GHSA-fw38-pc54-jvx9 Klever-Go KVM: Throttler slot leak in trie account-data sync causes epoch bootstrap / state sync DoS |
Medium EPSS 0.41% |
< 1.7.18 | 1.7.18 |
| GHSA-w342-mj6g-v9c4 Klever-Go KVM: Hash-array amplification in P2P resolver request handling |
High EPSS 0.49% |
< 1.7.18 | 1.7.18 |
| GHSA-w342-mj6g-v9c4 Klever-Go KVM: Hash-array amplification in P2P resolver request handling |
High EPSS 0.49% |
< 1.7.18 | 1.7.18 |
| GHSA-74m6-4hjp-7226 Klever-Go P2P MultiDataInterceptor leaks global throttler slots on malformed compressed batches (DoS) |
High | < 1.7.17 | 1.7.17 |
| GHSA-74m6-4hjp-7226 Klever-Go P2P MultiDataInterceptor leaks global throttler slots on malformed compressed batches (DoS) |
High | < 1.7.17 | 1.7.17 |
| GHSA-jc6w-wmfc-fh33 Klever-Go KVM read-only execution can commit contract delete and upgrade side effects |
Medium EPSS 0.48% |
< 1.7.17 | 1.7.17 |
| GHSA-jc6w-wmfc-fh33 Klever-Go KVM read-only execution can commit contract delete and upgrade side effects |
Medium EPSS 0.48% |
< 1.7.17 | 1.7.17 |
| GHSA-87m7-qffr-542v Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payload |
High EPSS 0.40% |
<= 1.7.16 | No fix yet |
| GHSA-87m7-qffr-542v Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payload |
High EPSS 0.40% |
all versions | No fix yet |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor