Read the docs
TI-2026-37979 Aliases CVE-2026-52880GHSA-w4c6-7r69-w7j9

Klever-Go: REST API slow-header connection exhaustion via Gin Engine.Run

Priority HIGH 72CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

Klever-Go is the Go implementation of the Klever blockchain protocol. Versions from 1.7.14 through 1.7.17 are vulnerable to a remotely triggerable denial of service. Both REST APIs are started with the Gin Engine.Run convenience method, which serves requests through Go's default HTTP server with no ReadHeaderTimeout, ReadTimeout, or MaxHeaderBytes configured. As a result, incoming connections that never complete their request headers are held open indefinitely. When a REST listener is reachable beyond localhost through the documented all-interface bind or a Docker port-publish deployment, a single unauthenticated client can open many slow-header connections and hold them open until server file descriptors are exhausted, preventing the API from accepting new connections. This renders the REST API unavailable to legitimate clients. This issue is fixed in version 1.7.18.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00488 42nd percentileScored 2026-11-07
Fix Fixed klever-go (klever-io): 1.7.18github.com/klever-io/klever-go (Go): 1.7.18

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
klever-ioklever-go1.7.14 to before 1.7.181.7.18Patch availableCNA
—github.com/klever-io/klever-go (Go)1.7.14 to before 1.7.181.7.18Patch availableGHSA-w4c6-7r69-w7j9
  • klever-go Vendorklever-io Affected 1.7.14 to before 1.7.18 Fixed in 1.7.18 Patch available CNA
  • github.com/klever-io/klever-go (Go) Vendor— Affected 1.7.14 to before 1.7.18 Fixed in 1.7.18 Patch available GHSA-w4c6-7r69-w7j9

Remediation

  • Fix · CNA klever-go (klever-io) Fixed in 1.7.18
  • Fix · GHSA-w4c6-7r69-w7j9 github.com/klever-io/klever-go (Go) Fixed in 1.7.18 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-52880
  2. 2026-10-03 Alias added: GHSA-w4c6-7r69-w7j9

References

Other 3

  • TI-2026-40253 Klever-Go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply CVSS 4.0HIGH 8.7
  • TI-2026-40252 Klever-Go: Percentage-transfer royalty skips the source debit at exactly-100% splits CVSS 4.0HIGH 8.7
  • TI-2026-58874 Klever-Go: /log controls global node logging CVSS 3.1HIGH 8.6
  • TI-2026-32588 Klever-Go MultiDataInterceptor: remote OOM via crafted compressed P2P payload CVSS 3.1HIGH 8.6
  • TI-2026-39560 Integer underflow in klever-io klever-go CVSS 3.1CRITICAL 9.6
  • TI-2026-58875 Resource allocation without limits in klever-io klever-go CVSS 3.1HIGH 7.5
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences