{"id":"CVE-2026-82407","kind":"vulnerability","aliases":["CVE-2026-82407","GHSA-9wh6-9hq7-9688","GO-2026-6586"],"related":[],"title":"Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS in github.com/klever-io/klever-go","description":"Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, core/kapp/validators/validators.go Register and the runtime validator update path accept a submitted BLSPublicKey without curve, prime-order subgroup, or nonzero validation. When a validator with a malformed key becomes eligible and is selected into a consensus group, MultiSigner.Reset and the corresponding signature verification creation path cannot deserialize the group key and cancel the slot. This causes repeated missed rounds and throughput degradation, and a network whose consensus group equals the eligible validator set can halt completely. Genesis validation is not affected because that path already performs CheckPublicKeyValid. This issue is fixed in version 1.7.20.","summary":"Klever-Go, the Go implementation of the Klever blockchain node, accepts validator registrations with a BLS public key that is never checked for curve or subgroup validity. A malformed key lets anyone who registers a validator cause repeated missed consensus rounds, and in some configurations a full network halt.","severity":"high","cvss":7.0,"epss":0.00434,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/klever-io/klever-go","fixed":["1.7.20"],"affected":"< 1.7.20","ecosystem":"go"}],"ecosystems":["go"],"tags":["blockchain-node","go","klever-go","package","validators"],"not_affected_if":["genesis-only-validators","version-1.7.20-or-later"],"how_to_check":"Run go list -m github.com/klever-io/klever-go in the node module and check whether the version is below 1.7.20.","fix":"Upgrade github.com/klever-io/klever-go to 1.7.20 or later.","status":"open","published_at":"2026-09-23T20:17:16+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T19:56:24+00:00","updated_at":"2026-10-23T19:56:24+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T19:56:24Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade github.com/klever-io/klever-go to 1.7.20 or later.\nunknown","summary":"Klever-Go, the Go implementation of the Klever blockchain node, accepts validator registrations with a BLS public key that is never checked for curve or subgroup validity. A malformed key lets anyone who registers a validator cause repeated missed consensus rounds, and in some configurations a full network halt.","category":"package","who_cares":["klever-go","blockchain-node","validators","go"],"confidence":0.7,"analyst_note":"Sources do not say whether a patched node can recover validators already registered with malformed keys; check the GO-2026-6586 advisory at https://pkg.go.dev/vuln/GO-2026-6586 and the NVD entry.","how_to_check":"Run go list -m github.com/klever-io/klever-go in the node module and check whether the version is below 1.7.20.\nunknown\nunknown","needs_analyst":true,"not_affected_if":["genesis-only-validators","version-1.7.20-or-later"],"severity_if_unknown":"high"},"cost_usd":0.000418,"input_tokens":2309,"output_tokens":375,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':20A,28A,31A '-6586':29A '-82407':21A,32A '/klever-io/klever-go':18A,35A '1.7.20':109C,203C '9688':26A '9hq7':25A '9wh6':24A 'accept':6A,56B,118C 'affect':190C 'alreadi':194C 'anyon':77B 'becom':138C 'blockchain':37B,54B,105C 'blockchain-nod':36B 'bls':9A,61B 'blspublickey':121C 'cancel':161C 'cannot':155C 'caus':82B,165C 'check':67B 'checkpublickeyvalid':196C 'complet':185C 'configur':90B 'consensus':12A,85B,145C,176C 'core/kapp/validators/validators.go':110C 'correspond':150C 'creation':153C 'curv':69B,123C 'cve':19A,30A 'degrad':171C 'deseri':156C 'dos':14A 'elig':139C,180C 'equal':178C 'fix':200C 'full':92B 'genesi':186C 'ghsa':23A 'ghsa-9wh6-9hq7':22A 'github.com':17A,34A 'github.com/klever-io/klever-go':16A,33A 'go':3A,27A,39B,42B,47B,49B,97C,100C 'group':146C,158C,177C 'halt':94B,184C 'implement':50B,101C 'issu':198C 'key':11A,63B,75B,137C,159C 'klever':2A,41B,46B,53B,96C,104C 'klever-go':1A,40B,45B,95C 'let':76B 'live':13A 'malform':74B,136C 'miss':84B,167C 'multisigner.reset':147C 'network':93B,174C 'never':66B 'node':38B,55B 'nonzero':129C 'order':126C 'packag':43B 'path':117C,154C,193C 'perform':195C 'prime':125C 'prime-ord':124C 'prior':107C 'protocol':106C 'public':10A,62B 'regist':79B,111C 'registr':5A,58B 'repeat':83B,166C 'round':86B,168C 'runtim':114C 'select':142C 'set':182C 'signatur':151C 'slot':163C 'subgroup':71B,127C 'submit':120C 'throughput':170C 'unvalid':8A 'updat':116C 'valid':4A,44B,57B,72B,81B,115C,130C,133C,181C,187C 'verif':152C 'version':202C 'whose':175C 'without':122C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-23T20:17:16+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6586","url":"https://pkg.go.dev/vuln/GO-2026-6586","severity":null,"published_at":"2026-10-01T20:23:38+00:00","modified_at":"2026-10-01T20:23:38+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-82407","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-82407","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-82407","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82407","severity":null,"published_at":"2026-09-23T20:17:16+00:00","modified_at":"2026-09-23T20:17:16+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}