https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Thu, 24 Sep 2026 20:42:24 +0000 https://vulnerability.circl.lu/sighting/20a8f3e2-4814-4c38-8d69-afa6b61d5a42/export {"uuid": "20a8f3e2-4814-4c38-8d69-afa6b61d5a42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86065", "type": "seen", "source": "https://gist.github.com/alon710/5492ab7cd525f5c1f9f536468a2a6ab4", "content": "# CVE-2026-86065: CVE-2026-86065: Denial of Service via Resource Exhaustion in klever-go WebSocket Subscription Endpoint\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-23\n> **Full Report:** https://cvereports.com/reports/CVE-2026-86065\n\n## Summary\nPrior to version 1.7.20, the default-open WebSocket `/subscribe` endpoint in klever-go was vulnerable to remote resource exhaustion. Unauthenticated, remote attackers could crash validator and node processes by exploiting unbounded frame reads, uncapped concurrent connections, unrestricted memory allocation for subscription address keys, and a permanent memory leak in subscription map tracking on client disconnects.\n\n## TL;DR\nUnauthenticated remote attackers can crash klever-go nodes via WebSocket resource exhaustion on the `/subscribe` endpoint, mitigated in v1.7.20.\n\n## Technical Details\n\n- **CWE ID**: CWE-770\n- **Attack Vector**: Network (Unauthenticated)\n- **CVSS v3.1**: 7.5 (High)\n- **Exploit Status**: None (Theoretical, except regression tests)\n- **KEV Status**: Not listed\n- **Remediation**: Upgrade to v1.7.20\n\n## Affected Systems\n\n- klever-go validator nodes\n- klever-go observer nodes\n- **klever-go**: < 1.7.20 (Fixed in: `1.7.20`)\n\n## Mitigation\n\n- Upgrade to klever-go version 1.7.20 or later.\n- Deploy reverse proxy with connection and rate limits.\n- Restrict public access to the /subscribe endpoint using firewall rules.\n\n**Remediation Steps:**\n1. Identify running klever-go daemon version.\n2. Download and compile the v1.7.20 release or newer.\n3. Restart the node with the updated binary.\n4. Verify websocket connection limits are active in configuration.\n\n## References\n\n- [GitHub Security Advisory GHSA-4fwh-wrm6-97xm](https://github.com/klever-io/klever-go/security/advisories/GHSA-4fwh-wrm6-97xm)\n- [Klever-Go Patch Commit](https://github.com/klever-io/klever-go/commit/b8af922e749ec1fa7451b2c6e7c9f634d8603be2)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-86065) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-23T21:31:11.070084Z"} {"uuid": "20a8f3e2-4814-4c38-8d69-afa6b61d5a42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86065", "type": "seen", "source": "https://gist.github.com/alon710/5492ab7cd525f5c1f9f536468a2a6ab4", "content": "# CVE-2026-86065: CVE-2026-86065: Denial of Service via Resource Exhaustion in klever-go WebSocket Subscription Endpoint\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-23\n> **Full Report:** https://cvereports.com/reports/CVE-2026-86065\n\n## Summary\nPrior to version 1.7.20, the default-open WebSocket `/subscribe` endpoint in klever-go was vulnerable to remote resource exhaustion. Unauthenticated, remote attackers could crash validator and node processes by exploiting unbounded frame reads, uncapped concurrent connections, unrestricted memory allocation for subscription address keys, and a permanent memory leak in subscription map tracking on client disconnects.\n\n## TL;DR\nUnauthenticated remote attackers can crash klever-go nodes via WebSocket resource exhaustion on the `/subscribe` endpoint, mitigated in v1.7.20.\n\n## Technical Details\n\n- **CWE ID**: CWE-770\n- **Attack Vector**: Network (Unauthenticated)\n- **CVSS v3.1**: 7.5 (High)\n- **Exploit Status**: None (Theoretical, except regression tests)\n- **KEV Status**: Not listed\n- **Remediation**: Upgrade to v1.7.20\n\n## Affected Systems\n\n- klever-go validator nodes\n- klever-go observer nodes\n- **klever-go**: < 1.7.20 (Fixed in: `1.7.20`)\n\n## Mitigation\n\n- Upgrade to klever-go version 1.7.20 or later.\n- Deploy reverse proxy with connection and rate limits.\n- Restrict public access to the /subscribe endpoint using firewall rules.\n\n**Remediation Steps:**\n1. Identify running klever-go daemon version.\n2. Download and compile the v1.7.20 release or newer.\n3. Restart the node with the updated binary.\n4. Verify websocket connection limits are active in configuration.\n\n## References\n\n- [GitHub Security Advisory GHSA-4fwh-wrm6-97xm](https://github.com/klever-io/klever-go/security/advisories/GHSA-4fwh-wrm6-97xm)\n- [Klever-Go Patch Commit](https://github.com/klever-io/klever-go/commit/b8af922e749ec1fa7451b2c6e7c9f634d8603be2)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-86065) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-23T21:31:11.070084Z"} https://vulnerability.circl.lu/sighting/20a8f3e2-4814-4c38-8d69-afa6b61d5a42/export Wed, 23 Sep 2026 21:31:11 +0000 https://vulnerability.circl.lu/sighting/1a45b6a6-7fe7-489c-94f7-79222f225401/export {"uuid": "1a45b6a6-7fe7-489c-94f7-79222f225401", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-86065", "type": "published-proof-of-concept", "source": "https://github.com/klever-io/klever-go/security/advisories/GHSA-4fwh-wrm6-97xm", "content": "", "creation_timestamp": "2026-09-23T20:35:04.571508Z"} {"uuid": "1a45b6a6-7fe7-489c-94f7-79222f225401", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-86065", "type": "published-proof-of-concept", "source": "https://github.com/klever-io/klever-go/security/advisories/GHSA-4fwh-wrm6-97xm", "content": "", "creation_timestamp": "2026-09-23T20:35:04.571508Z"} https://vulnerability.circl.lu/sighting/1a45b6a6-7fe7-489c-94f7-79222f225401/export Wed, 23 Sep 2026 20:35:04 +0000