CVE-2026-86065

Deferred Deferred - Pending Action

Klever-Go WebSocket Memory Exhaustion Vulnerability

Publication date: 2026-09-23

Last updated on: 2026-09-29

Assigner: GitHub, Inc.

Description

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /subscribe endpoint in network/api/websocket/routes.go accepts unauthenticated WebSocket clients with permissive origin handling, does not call SetReadLimit to bound message size, and has no live-connection cap. SocketHub.HandleClientInsertion also accepts an unbounded address list that grows addressSubscription, and client.loopIn continues reading without a size limit, allowing one client to grow subscription maps or many clients to retain goroutines, buffered channels, and descriptors. The global HTTP request throttler does not count upgraded live WebSocket connections. Because the REST and WebSocket API runs in the node process, memory or scheduler exhaustion can crash the node and interrupt P2P and consensus participation. This issue is fixed in version 1.7.20.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-29

Generated

2026-10-14

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-12

NVD

CVE-2026-86065

EUVD

EUVD-2026-85575

Affected Vendors & Products

Vendor	Product	Version / Range
klever	klever-go	1.7.20
klever-io	klever-go	to 1.7.19 (inc)
klever-io	klever-go	to 1.7.20 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

CVE-2026-86065 is a denial-of-service vulnerability in Klever-Go, the Go implementation of the Klever blockchain protocol. The issue involves the unauthenticated GET /subscribe WebSocket endpoint which lacks proper resource bounds. This allows remote attackers to exhaust server memory and goroutines by sending large WebSocket frames, maintaining excessive connections, or creating unbounded address subscriptions. The vulnerability stems from permissive origin handling, no read-size limits, and no connection or fan-out caps.

The vulnerability affects versions of Klever-Go prior to 1.7.20. Exploitation requires only a single TCP/WebSocket connection and can crash the entire node process, disrupting P2P and consensus participation since the REST and WebSocket APIs run in the same process.

Detection Guidance

Monitor for unusually high memory usage or goroutine counts in the Klever Go process. Check for excessive WebSocket connections to the /subscribe endpoint using netstat or ss commands like 'ss -tulnp | grep klever-go' or 'netstat -tulnp | grep :<port>'. Inspect logs for HTTP 503 responses indicating connection limits being hit.

Impact Analysis

This vulnerability can allow attackers to crash your Klever-Go node by exhausting its memory and goroutines. This would interrupt blockchain consensus and P2P communication, potentially causing network disruptions or downtime for your node. The attack requires no authentication or special privileges, just a network connection.

An attacker could send large WebSocket frames to consume server memory, establish many connections to exhaust goroutines, or create unbounded address subscriptions to grow internal data structures. All these actions can lead to an out-of-memory condition forcing the node to crash.

Compliance Impact

This vulnerability could lead to denial-of-service conditions by exhausting server resources, potentially disrupting services handling sensitive data. For GDPR, this may impact availability of personal data processing systems. For HIPAA, it could interrupt critical healthcare operations dependent on the blockchain node. Resource exhaustion risks violating requirements for availability and integrity of systems processing regulated data.

Mitigation Strategies

Upgrade to Klever Go version 1.7.20 or later immediately. If upgrading is not possible, disable the /subscribe endpoint or restrict access via firewall rules. Implement rate limiting and connection caps at the network level. Ensure Basic Auth is enforced for the /subscribe endpoint if configured as secured.

Hi! I’m here to help you understand CVE-2026-86065. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70