CVE-2026-86065 Details
Description
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /subscribe endpoint in network/api/websocket/routes.go accepts unauthenticated WebSocket clients with permissive origin handling, does not call SetReadLimit to bound message size, and has no live-connection cap. SocketHub.HandleClientInsertion also accepts an unbounded address list that grows addressSubscription, and client.loopIn continues reading without a size limit, allowing one client to grow subscription maps or many clients to retain goroutines, buffered channels, and descriptors. The global HTTP request throttler does not count upgraded live WebSocket connections. Because the REST and WebSocket API runs in the node process, memory or scheduler exhaustion can crash the node and interrupt P2P and consensus participation. This issue is fixed in version 1.7.20.
A vulnerability exists in the Klever-Go WebSocket API, specifically in the default-open GET /subscribe endpoint. This endpoint allows unauthenticated WebSocket clients to connect without restrictions, leading to potential resource exhaustion on the server. The vulnerability arises from several factors: permissive origin handling that accepts any web origin, the absence of a read-size limit on incoming WebSocket messages, and a lack of connection caps to limit the number of active WebSocket connections. As a result, an attacker can exploit these gaps to exhaust the node's memory and goroutines, causing a denial-of-service condition that disrupts the node's participation in peer-to-peer networking and consensus processes.
The vulnerability has been fixed in Klever-Go version 1.7.20. Users should upgrade to this version and ensure that their WebSocket /subscribe connections are properly authenticated and managed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/klever-io/klever-go/commit/b8af922e749ec1fa7451b2c6e7c9f634d8603be2 | [email protected] | Source CodeVendor |
| https://github.com/klever-io/klever-go/pull/76 | [email protected] | Issue TrackingVendor |
| https://github.com/klever-io/klever-go/releases/tag/v1.7.20 | [email protected] | Release NotesVendor |
| https://github.com/klever-io/klever-go/security/advisories/GHSA-4fwh-wrm6-97xm | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Klever-Go | <= 1.7.19 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 23, 2026 | New CVE Received | [email protected] |