CVE-2026-52880 Details
Description
Klever-Go is the Go implementation of the Klever blockchain protocol. Versions from 1.7.14 through 1.7.17 are vulnerable to a remotely triggerable denial of service. Both REST APIs are started with the Gin Engine.Run convenience method, which serves requests through Go's default HTTP server with no ReadHeaderTimeout, ReadTimeout, or MaxHeaderBytes configured. As a result, incoming connections that never complete their request headers are held open indefinitely. When a REST listener is reachable beyond localhost through the documented all-interface bind or a Docker port-publish deployment, a single unauthenticated client can open many slow-header connections and hold them open until server file descriptors are exhausted, preventing the API from accepting new connections. This renders the REST API unavailable to legitimate clients. This issue is fixed in version 1.7.18.
A denial-of-service vulnerability has been identified in Klever-Go, specifically in the REST API of the seednode and node components, versions 1.7.14 prior to 1.7.17. The issue arises because the Gin web framework's 'Engine.Run' method is used to start the REST API, which defaults to Go's standard HTTP server without proper header timeout or size limitations. This allows an unauthenticated client to open multiple connections by sending incomplete headers, keeping them open indefinitely. When the REST API is exposed beyond localhost, a single client can exhaust server file descriptors by maintaining these slow connections, causing the API to become unavailable for legitimate users.
Users are advised to upgrade to Klever-Go version 1.7.18, which patches this vulnerability by routing the REST API through a hardened HTTP server that includes appropriate timeout and header size restrictions. Instructions for upgrading can be found in the Klever-Go release notes.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 7, 2026CISA-ADP
Assessed Aug 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/klever-io/klever-go/security/advisories/GHSA-w4c6-7r69-w7j9 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/klever-io/klever-go/releases/tag/v1.7.18 | [email protected] | Release NotesVendor |
| https://github.com/klever-io/klever-go/security/advisories/GHSA-w4c6-7r69-w7j9 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Klever-Go | >= 1.7.14, <= 1.7.17 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 11, 2026 | CVE Modified | CISA-ADP |
| Aug 7, 2026 | New CVE Received | [email protected] |