CVE-2026-52880: Klever-Go Denial of Service Vulnerability

CVE-2026-52880 Overview

CVE-2026-52880 is a denial of service vulnerability in Klever-Go, the Go implementation of the Klever blockchain protocol. Affected versions 1.7.14 through 1.7.17 start both REST APIs using the Gin Engine.Run convenience method. This method serves requests through Go's default HTTP server without ReadHeaderTimeout, ReadTimeout, or MaxHeaderBytes configured. Unauthenticated remote attackers can open many slow-header connections and hold them open until server file descriptors are exhausted. The REST API then stops accepting new connections from legitimate clients. The issue is fixed in version 1.7.18.

Critical Impact
A single unauthenticated remote attacker can render the Klever-Go REST API unavailable by exhausting server file descriptors through slow-header connections.

Affected Products

Klever-Go 1.7.14
Klever-Go 1.7.15 through 1.7.16
Klever-Go 1.7.17

Discovery Timeline

2026-08-07 - CVE-2026-52880 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-52880

Vulnerability Analysis

CVE-2026-52880 is an uncontrolled resource consumption flaw [CWE-400] in the Klever-Go REST API layer. Both REST listeners are started with Gin Engine.Run, which wraps Go's default http.Server. This default server enforces no upper bound on how long a client may take to transmit its request headers. Connections that never complete their headers remain open indefinitely and continue to consume file descriptors.

When the listener is reachable beyond the loopback interface, such as through the documented all-interface bind or a Docker port-publish deployment, remote clients can exploit this behavior. An attacker opens many TCP connections and sends partial HTTP headers at a slow rate. Each connection consumes one file descriptor on the server. Once the process reaches its file descriptor limit, the accept loop fails and legitimate clients can no longer establish connections.

Root Cause

The root cause is missing timeout and size-limit configuration on the HTTP server used by the REST API. Specifically, ReadHeaderTimeout, ReadTimeout, and MaxHeaderBytes are all left at their permissive defaults. Without a header read timeout, the server cannot evict clients that stall during header transmission.

Attack Vector

The attack is remote, network-based, and requires no authentication or user interaction. An attacker with network reach to the REST port opens many concurrent TCP sessions, then dribbles header bytes at a slow rate to prevent header completion. This is the classic Slowloris pattern applied to a Go HTTP server that lacks read deadlines.

Detection Methods for CVE-2026-52880

Indicators of Compromise

Large number of concurrent TCP connections from a small set of source IP addresses to the Klever-Go REST API port.
Long-lived connections in ESTABLISHED state with no completed HTTP request logged on the server side.
Klever-Go process approaching or hitting its open file descriptor ulimit, followed by accept errors in logs.
Legitimate client reports of connection timeouts or refused connections against the REST API.

Detection Strategies

Monitor connection counts per source IP against the REST listener and alert on anomalous concentration.
Track the file descriptor usage of the Klever-Go process and alert when it approaches the configured limit.
Inspect HTTP access logs for a growing gap between accepted TCP connections and completed HTTP requests.

Monitoring Recommendations

Export process-level metrics such as open file descriptors, active goroutines, and accept queue depth to a time-series backend.
Place the REST API behind a reverse proxy that logs request duration and header read time, then alert on slow-header patterns.
Enable network flow logging on the host or Docker bridge to correlate TCP session duration with source addresses.

How to Mitigate CVE-2026-52880

Immediate Actions Required

Upgrade Klever-Go to version 1.7.18, which introduces server timeouts that terminate slow-header connections.
Restrict the REST listener bind address to 127.0.0.1 where remote access is not required.
If the API must be exposed, place it behind a reverse proxy such as Nginx or Envoy that enforces header read timeouts and per-client connection limits.
Review Docker -p port publishes and remove any that unintentionally expose the REST port to untrusted networks.

Patch Information

The vulnerability is fixed in Klever-Go v1.7.18. Release notes and the fix are available in the Klever Go Release v1.7.18 and the GitHub Security Advisory GHSA-w4c6-7r69-w7j9.

Workarounds

Bind the REST API to loopback only and access it through an SSH tunnel or private network overlay.
Enforce connection rate and concurrency limits at a reverse proxy or load balancer in front of the API.
Apply per-source connection caps at the host firewall using iptablesconnlimit or an equivalent stateful rule.
Lower operating system idle TCP timeouts and raise process ulimit -n only as a short-term buffer, not a fix.

bash

# Example Nginx reverse proxy hardening in front of the Klever-Go REST API
http {
    client_header_timeout 5s;
    client_body_timeout   5s;
    send_timeout          10s;
    limit_conn_zone $binary_remote_addr zone=perip:10m;

    server {
        listen 443 ssl;
        server_name klever.example.com;

        limit_conn perip 20;

        location / {
            proxy_pass http://127.0.0.1:8080;
            proxy_read_timeout 15s;
        }
    }
}