CVE-2026-82407

Name of the Vulnerable Software and Affected Versions Klever-Go versions prior to 1.7.20

Description Klever-Go, the Go implementation of the Klever blockchain protocol, fails to perform curve, prime-order subgroup, or nonzero validation on submitted BLSPublicKey during runtime validator registration and update paths. This occurs because the Register function in core/kapp/validators/validators.go and the runtime validator update path do not enforce these checks, unlike the genesis validation path which uses CheckPublicKeyValid().

An attacker can register a validator with a malformed 96-byte BLSPublicKey that is not a valid G2 point. When this validator is selected for a consensus group, the MultiSigner.Reset() function and the signature verification creation path (specifically the Create() function) fail to deserialize the group key. This results in the slot being canceled and the round being missed. Depending on the network size, this can lead to sustained throughput degradation or a complete chain halt if the consensus group equals the eligible validator set.

Recommendations Update to version 1.7.20. As a temporary mitigation, restrict the registration of new validators or the updating of validator configurations until the update is applied.