Live › vulnerability › CVE-2026-86065
Go to dashboardKlever-Go nodes before 1.7.20 expose an unauthenticated /subscribe WebSocket endpoint with no message size limit, no connection cap, and permissive origin checks. An attacker can exhaust memory or goroutines on the node, crashing it and interrupting P2P and consensus participation.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/klever-io/klever-go | go | < 1.7.20 | 1.7.20 |
1.7.20 (for example: go list -m github.com/klever-io/klever-go)1.7.20 or later and restart the nodeEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /subscribe endpoint in network/api/websocket/routes.go accepts unauthenticated WebSocket clients with permissive origin handling, does not call SetReadLimit to bound message size, and has no live-connection cap. SocketHub.HandleClientInsertion also accepts an unbounded address list that grows addressSubscription, and client.loopIn continues reading without a size limit, allowing one client to grow subscription maps or many clients to retain goroutines, buffered channels, and descriptors. The global HTTP request throttler does not count upgraded live WebSocket connections. Because the REST and WebSocket API runs in the node process, memory or scheduler exhaustion can crash the node and interrupt P2P and consensus participation. This issue is fixed in version 1.7.20.
This page as .md · .json · in your agent: get_signal("CVE-2026-86065")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.