CVE-2026-86065

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /subscribe endpoint in network/api/websocket/routes.go accepts unauthenticated WebSocket clients with permissive origin handling, does not call SetReadLimit to bound message size, and has no live-connection cap. SocketHub.HandleClientInsertion also accepts an unbounded address list that grows addressSubscription, and client.loopIn continues reading without a size limit, allowing one client to grow subscription maps or many clients to retain goroutines, buffered channels, and descriptors. The global HTTP request throttler does not count upgraded live WebSocket connections. Because the REST and WebSocket API runs in the node process, memory or scheduler exhaustion can crash the node and interrupt P2P and consensus participation. This issue is fixed in version 1.7.20.

• CWE-770

• https://github.com/klever-io/klever-go/commit/b8af922e749ec1fa7451b2c6e7c9f634d8603be2
• https://github.com/klever-io/klever-go/pull/76
• https://github.com/klever-io/klever-go/releases/tag/v1.7.20
• https://github.com/klever-io/klever-go/security/advisories/GHSA-4fwh-wrm6-97xm

Published

Sep 23, 2026

Last Modified

Sep 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-86056Notepad++ is a free and open-source source code editor. Prio…5.5
• CVE-2026-86059Dokploy is a free, self-hostable Platform as a Service (PaaS…9.6
• CVE-2026-8606A Server-Side Request Forgery (SSRF) vulnerability was ident…5.9
• CVE-2026-86060RouterOS contains an argument-handling flaw in the SSH login…9.8
• CVE-2026-86062LightRAG provides simple and fast retrieval-augmented genera…6.1
• CVE-2026-86064Klever-Go is the Go implementation of the Klever blockchain …8.6
• CVE-2026-86066Horilla is an HR and CRM software. Prior to 2.0.0, approve_v…5.9
• CVE-2026-8607The Points Management System For Gamification, Ranks, Badges…6.4
• CVE-2026-86071Junrar is an open source Java RAR archive library. Prior to …3.7
• CVE-2026-86073n8n is an open source workflow automation platform. Prior to…7.6
• CVE-2026-86074n8n is an open source workflow automation platform. Prior to…7.1
• CVE-2026-86075n8n is an open source workflow automation platform. Prior to…7.5