{"id":"CVE-2026-82407","aliases":["EUVD-2026-85576","GHSA-9wh6-9hq7-9688","GO-2026-6586"],"status":"published","title":"Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS","description":"Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, core/kapp/validators/validators.go Register and the runtime validator update path accept a submitted BLSPublicKey without curve, prime-order subgroup, or nonzero validation. When a validator with a malformed key becomes eligible and is selected into a consensus group, MultiSigner.Reset and the corresponding signature verification creation path cannot deserialize the group key and cancel the slot. This causes repeated missed rounds and throughput degradation, and a network whose consensus group equals the eligible validator set can halt completely. Genesis validation is not affected because that path already performs CheckPublicKeyValid. This issue is fixed in version 1.7.20.","severity":{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00466,"percentile":0.40648,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2026-09-23T19:17:59Z","modified":"2026-10-28T02:30:39Z","fixes":[{"ecosystem":"Go","package":"github.com/klever-io/klever-go","fixed_in":["1.7.20"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/klever-io/klever-go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.7.19"},{"fixed":"1.7.20"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/klever-io/klever-go","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.7.20"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/klever-io/klever-go","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.7.20"}]}]}],"products":[{"vendor":"klever-io","product":"klever-go"}],"references":[{"url":"https://github.com/klever-io/klever-go/security/advisories/GHSA-9wh6-9hq7-9688","tags":["x_refsource_CONFIRM","exploit","advisory","web"]},{"url":"https://github.com/klever-io/klever-go/commit/11606a90ccc289f93d0175994733229b332d9cff","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/klever-io/klever-go/commit/642da967893884d635986fed3c43bdc679cbfe8f","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/klever-io/klever-go/releases/tag/v1.7.20","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-9wh6-9hq7-9688"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82407.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82407","tags":["advisory"]},{"url":"https://github.com/klever-io/klever-go","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-82407","title":"Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS","description":"Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, core/kapp/validators/validators.go Register and the runtime validator update path accept a submitted BLSPublicKey without curve, prime-order subgroup, or nonzero validation. When a validator with a malformed key becomes eligible and is selected into a consensus group, MultiSigner.Reset and the corresponding signature verification creation path cannot deserialize the group key and cancel the slot. This causes repeated missed rounds and throughput degradation, and a network whose consensus group equals the eligible validator set can halt completely. Genesis validation is not affected because that path already performs CheckPublicKeyValid. This issue is fixed in version 1.7.20.","status":"published","published":"2026-09-23T19:17:59.006Z","modified":"2026-09-23T19:42:17.556Z","cvss":[{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","level":"high","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T13:40:46.161838Z"}],"euvd":[{"id":"EUVD-2026-85576","description":"Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, core/kapp/validators/validators.go Register and the runtime validator update path accept a submitted BLSPublicKey without curve, prime-order subgroup, or nonzero validation. When a validator with a malformed key becomes eligible and is selected into a consensus group, MultiSigner.Reset and the corresponding signature verification creation path cannot deserialize the group key and cancel the slot. This causes repeated missed rounds and throughput degradation, and a network whose consensus group equals the eligible validator set can halt completely. Genesis validation is not affected because that path already performs CheckPublicKeyValid. This issue is fixed in version 1.7.20.","status":"published","published":"2026-09-23T19:17:59Z","modified":"2026-09-23T19:42:17Z","cvss":[{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","level":"high"}],"updated_at":"2026-11-02T17:27:59.820483Z"}],"ghsa":[{"id":"GHSA-9wh6-9hq7-9688","title":"Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS","description":"**Location:** `core/kapp/validators/validators.go:201` (`Register`), (`genesis/checking/nodesSetupChecker.go:73`). `core/consensus/slot/bls/subslotStartSlot.go:165` `core/consensus/.../headerSignatureVerify.go:123` (`Create(...)`).\n\n### Description\n\nKlever uses a BDN (Boneh-Drijvers-Neven) BLS multi-signature over BLS12-381 to finalize blocks (`crypto/signing/mcl/multisig/bls.go`, herumi/bls-go-binary). The library is initialized with only `bls.Init(bls.BLS12_381)` and no order-verification flags, so `Deserialize` does not enforce prime-order-subgroup membership  subgroup safety relies on explicit `IsValidOrder()` calls in the wrappers.\n\nRuntime validator registration (`validators.Register`) stores the submitted 96-byte `BLSPublicKey` via `SetBLSPublicKey` with **no curve check, no subgroup check, and no proof-of-possession** (`CreateValidatorContract` carries the key but no signature proving key ownership; grep confirms no `proofOfPossession`/`VerifyProof`/`BLSSignature` verification anywhere in `core/kapp/validators/`). `CheckPublicKeyValid` — which does `IsValid \u0026\u0026 IsValidOrder \u0026\u0026 !IsZero` — runs only at genesis, not on runtime registration/update.\n\n### POC\n\nAttack: \n(1) stake the minimum to register a validator, submitting a 96-byte `BLSPublicKey` that is not a valid G2 point (arbitrary bytes). Registration succeeds. \n(2) Once the validator is eligible and selected into a consensus group, every in-group node  including the honest leader (`group[0]`)  calls `MultiSigner().Reset(groupPubKeys, selfIndex)` at slot start, which deserializes all group keys via `PublicKeyFromByteArray` → herumi `Deserialize` **deterministically fails** on the malformed key → `SetSlotCanceled(true)`. The verify side (`Create(consensusPubKeys)`) fails identically. No block is produced for that round. \n\n\n\n### Impact\n\nEvery consensus round whose group contains the malformed-key validator is a missed slot. One eligible bad-key validator poisons roughly a `groupSize / eligibleSet` fraction of rounds → sustained liveness degradation. **Where the consensus group equals the eligible set (small or early-stage networks), this is a full chain halt.** Cost is the minimum validator stake, permissionless, and repeatable; no fork flag gates the missing validation. \n\nRated **High** (Byzantine liveness; Critical on small validator sets). The severity scales down to a fractional missed-slot / throughput-degradation attack on a large validator set where the bad validator is only occasionally in the active group.\n\n### Recommendation\n\nEnforce `CheckPublicKeyValid` (curve + prime-order subgroup + non-zero) on the submitted BLS key at runtime validator registration and config-update, and ideally require a proof-of-possession (a BLS signature over the validator's own key/identity) at registration to prove key ownership and well-formedness. Gate the stricter validation behind an epoch fork flag for reprocessing consistency.","status":"published","published":"2026-09-23T21:24:08Z","modified":"2026-09-23T21:24:09Z","cvss":[{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:41:20.575159Z"}],"nvd":[{"id":"CVE-2026-82407","description":"Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, core/kapp/validators/validators.go Register and the runtime validator update path accept a submitted BLSPublicKey without curve, prime-order subgroup, or nonzero validation. When a validator with a malformed key becomes eligible and is selected into a consensus group, MultiSigner.Reset and the corresponding signature verification creation path cannot deserialize the group key and cancel the slot. This causes repeated missed rounds and throughput degradation, and a network whose consensus group equals the eligible validator set can halt completely. Genesis validation is not affected because that path already performs CheckPublicKeyValid. This issue is fixed in version 1.7.20.","status":"published","published":"2026-09-23T20:17:16.707Z","modified":"2026-09-23T20:17:16.847Z","cvss":[{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:12:51.036099Z"}],"osv":[{"id":"CVE-2026-82407","title":"Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS","description":"Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, core/kapp/validators/validators.go Register and the runtime validator update path accept a submitted BLSPublicKey without curve, prime-order subgroup, or nonzero validation. When a validator with a malformed key becomes eligible and is selected into a consensus group, MultiSigner.Reset and the corresponding signature verification creation path cannot deserialize the group key and cancel the slot. This causes repeated missed rounds and throughput degradation, and a network whose consensus group equals the eligible validator set can halt completely. Genesis validation is not affected because that path already performs CheckPublicKeyValid. This issue is fixed in version 1.7.20.","status":"published","published":"2026-09-23T19:17:59.006Z","modified":"2026-10-28T02:30:39.411843782Z","cvss":[{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:45:18.131258Z"},{"id":"GHSA-9wh6-9hq7-9688","title":"Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS","description":"**Location:** `core/kapp/validators/validators.go:201` (`Register`), (`genesis/checking/nodesSetupChecker.go:73`). `core/consensus/slot/bls/subslotStartSlot.go:165` `core/consensus/.../headerSignatureVerify.go:123` (`Create(...)`).\n\n### Description\n\nKlever uses a BDN (Boneh-Drijvers-Neven) BLS multi-signature over BLS12-381 to finalize blocks (`crypto/signing/mcl/multisig/bls.go`, herumi/bls-go-binary). The library is initialized with only `bls.Init(bls.BLS12_381)` and no order-verification flags, so `Deserialize` does not enforce prime-order-subgroup membership  subgroup safety relies on explicit `IsValidOrder()` calls in the wrappers.\n\nRuntime validator registration (`validators.Register`) stores the submitted 96-byte `BLSPublicKey` via `SetBLSPublicKey` with **no curve check, no subgroup check, and no proof-of-possession** (`CreateValidatorContract` carries the key but no signature proving key ownership; grep confirms no `proofOfPossession`/`VerifyProof`/`BLSSignature` verification anywhere in `core/kapp/validators/`). `CheckPublicKeyValid` — which does `IsValid \u0026\u0026 IsValidOrder \u0026\u0026 !IsZero` — runs only at genesis, not on runtime registration/update.\n\n### POC\n\nAttack: \n(1) stake the minimum to register a validator, submitting a 96-byte `BLSPublicKey` that is not a valid G2 point (arbitrary bytes). Registration succeeds. \n(2) Once the validator is eligible and selected into a consensus group, every in-group node  including the honest leader (`group[0]`)  calls `MultiSigner().Reset(groupPubKeys, selfIndex)` at slot start, which deserializes all group keys via `PublicKeyFromByteArray` → herumi `Deserialize` **deterministically fails** on the malformed key → `SetSlotCanceled(true)`. The verify side (`Create(consensusPubKeys)`) fails identically. No block is produced for that round. \n\n\n\n### Impact\n\nEvery consensus round whose group contains the malformed-key validator is a missed slot. One eligible bad-key validator poisons roughly a `groupSize / eligibleSet` fraction of rounds → sustained liveness degradation. **Where the consensus group equals the eligible set (small or early-stage networks), this is a full chain halt.** Cost is the minimum validator stake, permissionless, and repeatable; no fork flag gates the missing validation. \n\nRated **High** (Byzantine liveness; Critical on small validator sets). The severity scales down to a fractional missed-slot / throughput-degradation attack on a large validator set where the bad validator is only occasionally in the active group.\n\n### Recommendation\n\nEnforce `CheckPublicKeyValid` (curve + prime-order subgroup + non-zero) on the submitted BLS key at runtime validator registration and config-update, and ideally require a proof-of-possession (a BLS signature over the validator's own key/identity) at registration to prove key ownership and well-formedness. Gate the stricter validation behind an epoch fork flag for reprocessing consistency.","status":"published","published":"2026-09-23T21:24:08Z","modified":"2026-10-01T20:56:13.319048406Z","cvss":[{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:44.225359Z"},{"id":"GO-2026-6586","title":"Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS in github.com/klever-io/klever-go","description":"Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS in github.com/klever-io/klever-go","status":"published","published":"2026-10-01T20:23:38Z","modified":"2026-10-01T20:45:15.883717076Z","updated_at":"2026-11-02T15:47:03.11707Z"}]}}