Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS)

Summary The unauthenticated WebSocket endpoint GET /subscribe is registered open: true by default config/node/api.yaml and lets a remote, unauthenticated client exhaust the node's memory and goroutines. Because the REST API runs IN-PROCESS with the node — network/api/api.go Start... ends with...

GHSA-4FWH-WRM6-97XM Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS)

Summary The unauthenticated WebSocket endpoint GET /subscribe is registered open: true by default config/node/api.yaml and lets a remote, unauthenticated client exhaust the node's memory and goroutines. Because the REST API runs IN-PROCESS with the node — network/api/api.go Start... ends with...

CVE-2026-86065

Klever-Go , the Go implementation of the Klever blockchain protocol, is vulnerable to remote denial-of-service (DoS) via the unauthenticated GET /subscribe endpoint prior to version 1.7.20 . The vulnerability stems from three compounding gaps: permissive origin handling (allowing any web origin),...

EUVD-2026-85575

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /subscribe endpoint in network/api/websocket/routes.go accepts unauthenticated WebSocket clients with permissive origin handling, does not call SetReadLimit to bound message size, and has n...

CVE-2026-86065: Allocation of Resources Without Limits or Throttling

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /subscribe endpoint in network/api/websocket/routes.go accepts unauthenticated WebSocket clients with permissive origin handling, does not call SetReadLimit to bound message size, and has n...

PT-2026-97530

Name of the Vulnerable Software and Affected Versions Klever-Go versions prior to 1.7.20 Description The 'GET /subscribe' endpoint accepts unauthenticated WebSocket clients with permissive origin handling and lacks a live-connection cap or a call to SetReadLimit to bound message size. Additionall...