{"id":"EUVD-2026-85576","enisaUuid":"9d05aafd-3b45-374d-93cf-0585a132221a","description":"Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, core/kapp/validators/validators.go Register and the runtime validator update path accept a submitted BLSPublicKey without curve, prime-order subgroup, or nonzero validation. When a validator with a malformed key becomes eligible and is selected into a consensus group, MultiSigner.Reset and the corresponding signature verification creation path cannot deserialize the group key and cancel the slot. This causes repeated missed rounds and throughput degradation, and a network whose consensus group equals the eligible validator set can halt completely. Genesis validation is not affected because that path already performs CheckPublicKeyValid. This issue is fixed in version 1.7.20.","datePublished":"Sep 23, 2026, 7:17:59 PM","dateUpdated":"Sep 23, 2026, 7:42:17 PM","baseScore":7.0,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","references":"https://github.com/klever-io/klever-go/security/advisories/GHSA-9wh6-9hq7-9688\nhttps://github.com/klever-io/klever-go/commit/11606a90ccc289f93d0175994733229b332d9cff\nhttps://github.com/klever-io/klever-go/commit/642da967893884d635986fed3c43bdc679cbfe8f\nhttps://github.com/klever-io/klever-go/releases/tag/v1.7.20\n","aliases":"CVE-2026-82407\nGHSA-9wh6-9hq7-9688\n","assigner":"GitHub_M","epss":0.47,"enisaIdProduct":[{"id":"71d88d67-c710-3804-a113-ca5dbfd4ad09","product":{"name":"klever-go","vendor":{"name":"klever-io"}},"product_version":"\u003c 1.7.20"}],"enisaIdVendor":[{"id":"c64f8bdf-587c-3936-8eaf-e8325bd7c3da","vendor":{"name":"klever-io"}}],"enisaIdVulnerability":[{"id":"7891fec7-7768-3a5a-a09b-7ef4386a6ee5","vulnerability":{"id":"GHSA-9wh6-9hq7-9688","description":"Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS","datePublished":"Sep 23, 2026, 9:24:08 PM","dateUpdated":"Sep 23, 2026, 9:24:08 PM","baseScore":0.0,"references":"https://github.com/klever-io/klever-go/security/advisories/GHSA-9wh6-9hq7-9688\nhttps://github.com/klever-io/klever-go/commit/11606a90ccc289f93d0175994733229b332d9cff\nhttps://github.com/klever-io/klever-go/commit/642da967893884d635986fed3c43bdc679cbfe8f\nhttps://github.com/klever-io/klever-go\nhttps://github.com/klever-io/klever-go/releases/tag/v1.7.20\n","enisa_id":"EUVD-2026-85576\n","aliases":"CVE-2026-82407\nGHSA-9wh6-9hq7-9688\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:53:48 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"f46f4c5e-ec89-31a0-a387-37b5e1933a3c","vulnerability":{"id":"CVE-2026-82407","description":"Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, core/kapp/validators/validators.go Register and the runtime validator update path accept a submitted BLSPublicKey without curve, prime-order subgroup, or nonzero validation. When a validator with a malformed key becomes eligible and is selected into a consensus group, MultiSigner.Reset and the corresponding signature verification creation path cannot deserialize the group key and cancel the slot. This causes repeated missed rounds and throughput degradation, and a network whose consensus group equals the eligible validator set can halt completely. Genesis validation is not affected because that path already performs CheckPublicKeyValid. This issue is fixed in version 1.7.20.","datePublished":"Sep 23, 2026, 7:17:59 PM","dateUpdated":"Sep 23, 2026, 7:42:17 PM","status":"PUBLISHED","baseScore":7.0,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","references":"https://github.com/klever-io/klever-go/security/advisories/GHSA-9wh6-9hq7-9688\nhttps://github.com/klever-io/klever-go/commit/11606a90ccc289f93d0175994733229b332d9cff\nhttps://github.com/klever-io/klever-go/commit/642da967893884d635986fed3c43bdc679cbfe8f\nhttps://github.com/klever-io/klever-go/releases/tag/v1.7.20\n","enisa_id":"EUVD-2026-85576\n","assigner":"GitHub_M","epss":0.47,"dataProcessed":"Nov 11, 2026, 7:25:54 AM","vulnerabilityProduct":[{"id":"1fcf0ed4-7f02-3efa-b33a-4fe83e096952","product":{"name":"klever-go","vendor":{"name":"klever-io"}},"product_version":"\u003c 1.7.20"}],"vulnerabilityVendor":[{"id":"626a8bba-ff49-3ef1-b902-f03726c754cb","vendor":{"name":"klever-io"}}]}}],"enisaIdAdvisory":[]}