Klever‑Go's REST APIs are started with Gin Engine.Run, which does not configure a header read timeout or maximum header size. This allows an unauthenticated remote client to open many connections that send incomplete headers and remain open indefinitely. The server keeps each connection on a file descriptor until the request completes or times out, so an attacker can exhaust all available descriptors and make the API refuse new connections, effectively denying service to legitimate users. This vulnerability is a classic example of uncontrolled resource consumption (CWE‑400) and can also lead to memory exhaustion (CWE‑770).

The affected product is Klever‑Go, the Go implementation of the Klever blockchain protocol. Versions 1.7.14 through 1.7.17 are vulnerable. The vulnerability was fixed in release 1.7.18. Any deployment that exposes the REST endpoint on a non‑localhost interface or publishes the port via Docker is susceptible. Systems running the vulnerable versions on any operating system platform are affected.

The CVSS score for this issue is 7.5, indicating a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote network, leveraging the REST API's lack of timeout configuration. An unauthenticated client can open thousands of slow‑header connections in a short period, exhausting file descriptors and causing a denial of service. Because the exploit requires only network access to the REST port, it can be performed from outside the network if the port is exposed.