Klever-Go's default /subscribe WebSocket endpoint allows unauthenticated clients, permits any origin, and does not set a read-size limit or limit concurrent connections. This design lets an attacker open many connections or send oversized messages, causing the server to allocate unbounded goroutines, channels, and memory, eventually exhausting scheduler or memory and crashing the node. The issue specifically enables an attacker to disrupt the blockchain node's availability; it does not involve data confidentiality or integrity damage.

Vulnerable versions of Klever-Go are those earlier than 1.7.20. The affected code resides in network/api/websocket/routes.go and SocketHub.HandleClientInsertion, where unbounded subscription maps and lack of connection throttling lead to potential DoS. The vulnerability is present in the klever-io:klever-go product and all deployments that expose the GET /subscribe endpoint without sector-specific authentication.

With a CVSS base score of 7.5, the vulnerability is considered high severity. No EPSS score is provided, and it is not listed in the CISA KEV catalog. Because the attack path is simply establishing WebSocket connections to the open /subscribe endpoint, there are no special privileges required. An unauthenticated attacker can repeatedly spawn client connections or send large payloads to drain node resources, causing the node to crash or become unresponsive. Prompt patching mitigates the risk; before a fix is applied, exposure to DoS remains elevated.