Klever-Go CVE-2026-52880

Exploitation requires that the REST API listener is bound to a non-localhost interface, which occurs in two documented deployment scenarios: use of the --rest-api-interface :8080 flag (documented as the default binding example in cmd/node/CLI.md and cmd/seednode/CLI.md, binding all interfaces) or Docker deployments following the official docker/README.md examples that publish host port 8080. If the REST API is configured as --rest-api-interface off, the attack surface is entirely eliminated. If the flag is set to a loopback-only address such as 127.0.0.1:8080, the vulnerability is not remotely exploitable. No authentication is required (PR:N confirmed by CVSS vector); any TCP client capable of reaching port 8080 and withholding HTTP header completion can participate. The attack does not require P2P network access, blockchain protocol knowledge, or any application-level credentials - only TCP connectivity to the REST port.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H and base score of 7.5 accurately characterize this vulnerability: fully network-reachable, trivially low complexity, requiring no authentication or user interaction, with full availability impact and no confidentiality or integrity loss. There is no CISA KEV listing, indicating no confirmed widespread active exploitation in the wild. However, the existence of a working proof-of-concept documented in the vendor advisory substantially elevates real-world risk: the attack technique is a well-understood slow-loris-style HTTP exhaustion approach that requires no specialized tooling, is trivially automatable, and needs only 120 connections to fully block a node. EPSS data was not provided in the source intelligence. The attack surface is meaningfully expanded in Docker deployments - the official docker/README.md examples publish host port 8080, directly exposing the REST listener to network adversaries without additional network controls. The vulnerability is limited to availability; there is no lateral escalation path or data exfiltration risk. For node operators running the documented :8080 all-interface bind or a Docker port-publish deployment, this is a genuine operational priority despite the absence of KEV listing.

An unauthenticated attacker with network access to the Klever node's REST API port (default 8080) opens a large number of TCP connections and sends the beginning of an HTTP request header on each - enough bytes to pass TCP keepalive but never enough to complete the header line. Because no ReadHeaderTimeout is configured, the server holds a goroutine and file descriptor open per connection indefinitely; once the process file descriptor limit is reached, the OS cannot hand new sockets to the application. The GHSA advisory documented a working PoC on v1.7.17 in which 120 slow-header connections caused all 20 of 20 legitimate /log probe requests to fail with 'accept: too many open files', fully denying API service to legitimate clients.