-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0178
============================================================

Advisory-ID:  0xCERT-2026-0178
Severity:     High
Published:    2026-09-23T20:17:20.160Z
Updated:      2026-10-08T22:46:37.825Z
Chains:       BNB Chain
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0178

Title: CVE-2026-86065: Klever-Go

Summary
- -------
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /subscribe endpoint in network/api/websocket/routes.go accepts unauthenticated WebSocket clients with permissive origin handling, does not call SetReadLimit to bound message size, and has no live-connection cap. SocketHub.HandleClientInsertion also accepts an unbounded address list that grows addressSubscription, and client.loopIn continues reading without a size limit, allowing one client to grow subscription maps or many clients to retain goroutines, buffered channels, and descriptors…

Details
- -------
Summary
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /subscribe endpoint in network/api/websocket/routes.go accepts unauthenticated WebSocket clients with permissive origin handling, does not call SetReadLimit to bound message size, and has no live-connection cap. SocketHub.HandleClientInsertion also accepts an unbounded address list that grows addressSubscription, and client.loopIn continues reading without a size limit, allowing one client to grow subscription maps or many clients to retain goroutines, buffered channels, and descriptors. The global HTTP request throttler does not count upgraded live WebSocket connections. Because the REST and WebSocket API runs in the node process, memory or scheduler exhaustion can crash the node and interrupt P2P and consensus participation. This issue is fixed in version 1.7.20.

Severity
High (CVSS 7.5), as scored by NVD.

Weakness
- - CWE-770

Recommended actions
- - Check whether you run or depend on the affected component and version
- - Apply the vendor's fix or mitigation from the references below

Source & attribution
This 0xCERT advisory summarises CVE-2026-86065 from the U.S. National Vulnerability Database: https://nvd.nist.gov/vuln/detail/CVE-2026-86065. Details may change; refer to the original source for the authoritative record.

References
- ----------
- - https://nvd.nist.gov/vuln/detail/CVE-2026-86065
- - https://github.com/klever-io/klever-go/commit/b8af922e749ec1fa7451b2c6e7c9f634d8603be2
- - https://github.com/klever-io/klever-go/pull/76
- - https://github.com/klever-io/klever-go/releases/tag/v1.7.20
- - https://github.com/klever-io/klever-go/security/advisories/GHSA-4fwh-wrm6-97xm
- - https://github.com/klever-io/klever-go/security/advisories/GHSA-4fwh-wrm6-97xm

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0FgmrIRqkJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcmcPQc7aNYsQnbcRFZR8m4xaD/MU6CJ+4yKlo5Ai
jxUOvBYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAACryQD9Fgs9rx3AxL4DBCv0
nprisP98njB2MdfxqVSBLgxFdk4A/1Hmtr7X5bI6nEPhyU4uiyZuG3gwI2LB
bXFPLYoZEIUD
=tqvo
-----END PGP SIGNATURE-----