CVE-2026-82407

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-82407

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82407.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-82407

Aliases

GHSA-9wh6-9hq7-9688

Published

2026-09-23T19:17:59Z

Modified

2026-09-24T03:46:22Z

Severity

7.0 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H CVSS Calculator

Summary

Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS

Details

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, core/kapp/validators/validators.go Register and the runtime validator update path accept a submitted BLSPublicKey without curve, prime-order subgroup, or nonzero validation. When a validator with a malformed key becomes eligible and is selected into a consensus group, MultiSigner.Reset and the corresponding signature verification creation path cannot deserialize the group key and cancel the slot. This causes repeated missed rounds and throughput degradation, and a network whose consensus group equals the eligible validator set can halt completely. Genesis validation is not affected because that path already performs CheckPublicKeyValid. This issue is fixed in version 1.7.20.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-20"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82407.json"
}

References

Affected packages

Git / github.com/klever-io/klever-go

Affected ranges

Type

GIT

Repo

https://github.com/klever-io/klever-go

Events

Introduced

Fixed

0b70b0f1a1f5d95ac07c2038c227db7f18976a2a

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "1.7.20"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

v1.*

v1.7.14

v1.7.15

v1.7.16

v1.7.17

v1.7.18

v1.7.19

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82407.json"