CVE-2026-44697
CVE-2026-44697 is a high-severity vulnerability with a CVSS 3.x base score of 8.6. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-409.
Key facts
- Severity: High (CVSS 3.x base score 8.6)
- EPSS exploit prediction: 0% (31st percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2026-33375
- Weakness: CWE-409
- Published:
- Last modified:
Description
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.17, a remote, unauthenticated denial-of-service vulnerability in Batch.Decompress (data/batch/batch.go) allows any peer that participates in a topic served by MultiDataInterceptor to allocate multi-gigabyte heaps on the receiving node from a sub-50 KiB gossip payload. A single packet is sufficient to OOM-kill a validator with conventional memory provisioning. Fleet-wide application affects chain liveness. This vulnerability is fixed in 1.7.17.
Frequently asked questions
- What is CVE-2026-44697?
- Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.17, a remote, unauthenticated denial-of-service vulnerability in Batch.Decompress (data/batch/batch.go) allows any peer that participates in a topic served by MultiDataInterceptor to allocate multi-gigabyte heaps on the receiving node from a sub-50 KiB gossip payload. A single packet is sufficient to OOM-kill a validator with conventional memory provisioning. Fleet-wide application affects chain liveness. This vulnerability is fixed in 1.7.17.
- How severe is CVE-2026-44697?
- CVE-2026-44697 has a CVSS 3.x base score of 8.6, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
- Is CVE-2026-44697 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (31st percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2026-44697?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- Does CVE-2026-44697 have an EU (EUVD) identifier?
- Yes. CVE-2026-44697 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-33375.
- When was CVE-2026-44697 published?
- CVE-2026-44697 was published on 2026-05-29 and last updated on 2026-07-21.
References
Other CWE-409 vulnerabilities
- CVE-2026-62963 — High (CVSS 8.7): Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.4, Centrifugo unidirectional WebSocket…
- CVE-2026-55195 — High (CVSS 8.7): py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and…
- CVE-2026-53430 — High (CVSS 8.7): Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc…
- CVE-2026-44981 — High (CVSS 8.2): CrowdSec offers crowdsourced protection against malicious IPs. From 1.7.0 until 1.7.8, the LAPI router used…
- CVE-2026-43970 — High (CVSS 8.2): Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in ninenines cowlib allows…
- CVE-2026-75936 — High (CVSS 7.5): Improper handling of highly compressed data in the GZIP auto-decompression handler in Amazon ion-java before 1.12.0…