CVE-2026-52880

Name of the Vulnerable Software and Affected Versions klever-go versions 1.7.14 through 1.7.17

Description The REST API in the seednode and node components is susceptible to a denial of service attack. This occurs because the application uses the Gin framework's Engine.Run function, which relies on Go's default http.ListenAndServe. This default implementation lacks application-level limits for ReadHeaderTimeout, ReadTimeout, and MaxHeaderBytes.

An unauthenticated client can exploit this by opening multiple connections and sending incomplete HTTP headers indefinitely. This exhausts server resources, leading to a state where the server cannot accept new legitimate connections, resulting in the unavailability of the REST API. This issue is particularly relevant when the API is bound to all interfaces using the --rest-api-interface flag or when deployed via Docker with port 8080 published.

Recommendations For versions 1.7.14 through 1.7.17, replace the use of Engine.Run in cmd/seednode/api.Start and network/api.Start with an explicit http.Server configuration that defines ReadHeaderTimeout, ReadTimeout, WriteTimeout, IdleTimeout, and MaxHeaderBytes.

As a temporary mitigation, avoid binding the REST API to all interfaces via the --rest-api-interface flag or restrict access to port 8080 using an external firewall or reverse proxy that enforces header timeouts.