CVE-2026-58262

Name of the Vulnerable Software and Affected Versions Klever-Go versions prior to 1.7.20

Description Header signature verification incorrectly counts unused padding bits of the PubKeysBitmap toward the two-thirds validator quorum. Because these padding bits do not correspond to any validator and are ignored by the BLS aggregate-signature check, a malicious or compromised block producer can manipulate them to simulate the required quorum with fewer genuine validator signatures than required. This allows nodes to accept headers as correctly signed without a real two-thirds quorum, which weakens consensus safety and undermines finality.

Recommendations Update to version 1.7.20.