CVE-2026-82407: Klever-Go BLS Key Validation DOS Vulnerability

CVE-2026-82407 Overview

CVE-2026-82407 is an input validation flaw [CWE-20] in Klever-Go, the Go implementation of the Klever blockchain protocol. Versions prior to 1.7.20 accept a submitted BLSPublicKey during validator registration and update without curve, prime-order subgroup, or nonzero checks. When a validator with a malformed key becomes eligible and enters a consensus group, MultiSigner.Reset and the signature verification path fail to deserialize the group key, cancelling the slot. The result is repeated missed rounds, throughput degradation, and potential full network halt when the consensus group equals the eligible validator set. Genesis validation is unaffected because that path already calls CheckPublicKeyValid.

Critical Impact
A low-privileged validator registrant can submit a malformed BLS public key that halts consensus rounds and can stop the entire network when the consensus group equals the eligible validator set.

Affected Products

Klever-Go blockchain node software prior to version 1.7.20
The core/kapp/validators/validators.goRegister path
The runtime validator update path in Klever-Go

Discovery Timeline

2026-09-23 - CVE-2026-82407 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-82407

Vulnerability Analysis

The defect is an improper input validation issue in Klever-Go's validator management layer. The Register function in core/kapp/validators/validators.go and the runtime validator update path accept BLS public keys from transaction submitters without verifying that the key is a valid point on the curve, lies in the prime-order subgroup, or is nonzero.

Once accepted, the malformed key is stored as validator state. When the epoch schedule promotes that validator into a consensus group, downstream cryptographic components attempt to deserialize the aggregate group key. The deserialization fails, MultiSigner.Reset returns an error, and the signature verification creation path cancels the affected consensus slot.

The practical effect is denial of service against block production. Each slot involving the malformed key is skipped, causing missed rounds and throughput degradation. If every eligible validator is part of the consensus group, the chain halts entirely.

Root Cause

The root cause is missing cryptographic validation on attacker-controlled input. CheckPublicKeyValid is invoked during genesis processing but is not invoked on the validator Register or update paths, so keys that would be rejected at genesis are silently persisted at runtime.

Attack Vector

An attacker who controls a validator registration or update transaction submits a BLSPublicKey that is not a valid curve point, not in the prime-order subgroup, or is zero. The transaction succeeds, the malformed key enters the eligible set, and consensus slots involving that validator fail deterministically.

// Patch: introduces an explicit error for invalid BLS keys in common/errors.go
// ErrNilBLSPublicKey signals that the provided BLS public key is nil
var ErrNilBLSPublicKey = errors.New("bls public key is nil")

// ErrInvalidBLSPublicKey signals that the provided BLS public key is not a valid curve point
var ErrInvalidBLSPublicKey = errors.New("invalid bls public key")

// ErrNilEpochNotifier signals that the provided EpochNotifier is nil
var ErrNilEpochNotifier = errors.New("nil EpochNotifier")

Source: GitHub commit 11606a9

// Patch: validators.go now imports signing and mcl to validate BLS keys on register/update
	"github.com/klever-io/klever-go/core/kapp"
	"github.com/klever-io/klever-go/core/process"
	txProcess "github.com/klever-io/klever-go/core/process/transaction"
	"github.com/klever-io/klever-go/crypto/signing"
	"github.com/klever-io/klever-go/crypto/signing/mcl"
	"github.com/klever-io/klever-go/data/state"
	"github.com/klever-io/klever-go/data/transaction"
	"github.com/klever-io/klever-go/kapps"

Source: GitHub commit 642da96

Detection Methods for CVE-2026-82407

Indicators of Compromise

Validator Register or update transactions containing BLSPublicKey values that fail CheckPublicKeyValid when replayed offline.
Recurring MultiSigner.Reset deserialization errors in node logs tied to a specific validator public key.
Repeated cancelled consensus slots associated with the same eligible validator across successive epochs.

Detection Strategies

Replay recent validator registration and update transactions through a validator that invokes CheckPublicKeyValid and alert on any key that fails curve, subgroup, or nonzero checks.
Correlate node consensus telemetry for missed rounds with the validator public keys scheduled for those slots to identify a persistent malformed key source.
Monitor for a sustained drop in observed block throughput without a corresponding change in network participation or peer count.

Monitoring Recommendations

Ingest Klever-Go node logs, consensus round metrics, and validator set changes into a centralized analytics pipeline for correlation.
Alert on any error string matching invalid bls public key or repeated MultiSigner.Reset failures after upgrading to 1.7.20.
Track validator eligibility changes per epoch and flag newly promoted validators that trigger slot cancellations.

How to Mitigate CVE-2026-82407

Immediate Actions Required

Upgrade all Klever-Go nodes to version 1.7.20 or later, which enforces BLS key validation on both the Register and validator update paths.
Audit the current eligible validator set for any BLS public keys that fail CheckPublicKeyValid and remove or replace them before promoting affected validators into a consensus group.
Review recent validator registration and update transactions for malformed key submissions and identify the originating accounts.

Patch Information

The fix is available in Klever-Go release v1.7.20. The remediation adds ErrInvalidBLSPublicKey in common/errors.go and wires crypto/signing and crypto/signing/mcl into core/kapp/validators/validators.go so that BLS public keys are validated on register and update. Full technical details are published in GitHub Security Advisory GHSA-9wh6-9hq7-9688.

Workarounds

No official workaround exists; operators must upgrade to 1.7.20 to obtain the validation logic.
As an interim measure, restrict which accounts can submit validator registration or update transactions using existing governance or permissioning controls.
Operate a monitoring validator that pre-validates submitted BLS keys against curve and subgroup membership and raises alerts before those keys enter the eligible set.

bash

# Upgrade Klever-Go to the patched release
git clone https://github.com/klever-io/klever-go.git
cd klever-go
git checkout v1.7.20
make build

# Verify the running binary reports version 1.7.20 before returning the node to consensus
./klever-go --version