CVE-2026-86065

Name of the Vulnerable Software and Affected Versions Klever-Go versions prior to 1.7.20

Description The 'GET /subscribe' endpoint accepts unauthenticated WebSocket clients with permissive origin handling and lacks a live-connection cap or a call to SetReadLimit to bound message size. Additionally, the SocketHub.HandleClientInsertion() function accepts an unbounded address list that increases the size of addressSubscription, while client.loopIn() continues reading without a size limit. This allows a single client to expand subscription maps or multiple clients to consume goroutines, buffered channels, and descriptors. Since the global HTTP request throttler does not account for upgraded live WebSocket connections and the API runs within the node process, memory or scheduler exhaustion can crash the node, interrupting P2P and consensus participation.

Recommendations Update to version 1.7.20.