CVE-2026-86065

## Summary The unauthenticated WebSocket endpoint `GET /subscribe` is registered `open: true` by default (`config/node/api.yaml`) and lets a remote, unauthenticated client exhaust the node's memory and goroutines. Because the REST API runs IN-PROCESS with the node — `network/api/api.go` `Start(...)` ends with `ws.Run(kleverFacade.RestAPIInterface())` — exhausting/killing the API process takes down the entire node, including its P2P and consensus participation. No API key, account, stake, or funds are required. Three compounding, independently-exploitable gaps stack on this one endpoint: 1. Permissive origin — `upgrader.CheckOrigin` always returns `true` (`network/api/websocket/routes.go`), so any web origin can complete the handshake. 2. No read-size limit — the connection never calls `conn.SetReadLimit(...)`. gorilla's default is UNLIMITED, so a single `conn.ReadJSON` (`processSubscription`) or `conn.ReadMessage` (`client.loopIn`) can be forced to allocate an arbitrarily large buffer from ONE frame. 3. No connection / fan-out cap — the gin global throttler (`simultaneousRequests: 100`) releases its slot as soon as `handleSubscribe` returns, which it does immediately after `go processSubscription(conn, hub)`. Live WebSocket connections are therefore NOT counted by it. There is no per-IP / per-connection / hub-level cap. Each accepted connection spawns 2 goroutines plus a 500-entry buffered channel, and `req.Addresses` has no length cap, so the hub's `addressSubscription` map grows 1:1 with attacker-supplied strings. ## Affected Component / Code Path Unauthenticated, reachable by default, no recovery on the resource-allocation path: ``` gin engine (network/api/api.go: Start -> ws.Run, IN-PROCESS with node) -> GET /subscribe network/api/websocket/routes.go:34 (SubscribeTopics) -> handleSubscribe network/api/websocket/routes.go:39 -> upgrader.Upgrade (CheckOrigin == true) ne