Vulnerability-Lookup

GHSA-9WH6-9HQ7-9688

Vulnerability from github – Published: 2026-09-23 21:24 – Updated: 2026-09-23 21:24

Summary

Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS

Details

Location: core/kapp/validators/validators.go:201 (Register), (genesis/checking/nodesSetupChecker.go:73). core/consensus/slot/bls/subslotStartSlot.go:165 core/consensus/.../headerSignatureVerify.go:123 (Create(...)).

Description

Klever uses a BDN (Boneh-Drijvers-Neven) BLS multi-signature over BLS12-381 to finalize blocks (crypto/signing/mcl/multisig/bls.go, herumi/bls-go-binary). The library is initialized with only bls.Init(bls.BLS12_381) and no order-verification flags, so Deserialize does not enforce prime-order-subgroup membership subgroup safety relies on explicit IsValidOrder() calls in the wrappers.

Runtime validator registration (validators.Register) stores the submitted 96-byte BLSPublicKey via SetBLSPublicKey with no curve check, no subgroup check, and no proof-of-possession (CreateValidatorContract carries the key but no signature proving key ownership; grep confirms no proofOfPossession/VerifyProof/BLSSignature verification anywhere in core/kapp/validators/). CheckPublicKeyValid — which does IsValid && IsValidOrder && !IsZero — runs only at genesis, not on runtime registration/update.

POC

Attack: (1) stake the minimum to register a validator, submitting a 96-byte BLSPublicKey that is not a valid G2 point (arbitrary bytes). Registration succeeds. (2) Once the validator is eligible and selected into a consensus group, every in-group node including the honest leader (group[0]) calls MultiSigner().Reset(groupPubKeys, selfIndex) at slot start, which deserializes all group keys via PublicKeyFromByteArray → herumi Deserialize deterministically fails on the malformed key → SetSlotCanceled(true). The verify side (Create(consensusPubKeys)) fails identically. No block is produced for that round.

Impact

Every consensus round whose group contains the malformed-key validator is a missed slot. One eligible bad-key validator poisons roughly a groupSize / eligibleSet fraction of rounds → sustained liveness degradation. Where the consensus group equals the eligible set (small or early-stage networks), this is a full chain halt. Cost is the minimum validator stake, permissionless, and repeatable; no fork flag gates the missing validation.

Rated High (Byzantine liveness; Critical on small validator sets). The severity scales down to a fractional missed-slot / throughput-degradation attack on a large validator set where the bad validator is only occasionally in the active group.

Recommendation

Enforce CheckPublicKeyValid (curve + prime-order subgroup + non-zero) on the submitted BLS key at runtime validator registration and config-update, and ideally require a proof-of-possession (a BLS signature over the validator's own key/identity) at registration to prove key ownership and well-formedness. Gate the stricter validation behind an epoch fork flag for reprocessing consistency.

Severity

7.0 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.7.19"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/klever-io/klever-go"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.7.20"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-82407"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-23T21:24:08Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "**Location:** `core/kapp/validators/validators.go:201` (`Register`), (`genesis/checking/nodesSetupChecker.go:73`). `core/consensus/slot/bls/subslotStartSlot.go:165` `core/consensus/.../headerSignatureVerify.go:123` (`Create(...)`).\n\n### Description\n\nKlever uses a BDN (Boneh-Drijvers-Neven) BLS multi-signature over BLS12-381 to finalize blocks (`crypto/signing/mcl/multisig/bls.go`, herumi/bls-go-binary). The library is initialized with only `bls.Init(bls.BLS12_381)` and no order-verification flags, so `Deserialize` does not enforce prime-order-subgroup membership  subgroup safety relies on explicit `IsValidOrder()` calls in the wrappers.\n\nRuntime validator registration (`validators.Register`) stores the submitted 96-byte `BLSPublicKey` via `SetBLSPublicKey` with **no curve check, no subgroup check, and no proof-of-possession** (`CreateValidatorContract` carries the key but no signature proving key ownership; grep confirms no `proofOfPossession`/`VerifyProof`/`BLSSignature` verification anywhere in `core/kapp/validators/`). `CheckPublicKeyValid` \u2014 which does `IsValid \u0026\u0026 IsValidOrder \u0026\u0026 !IsZero` \u2014 runs only at genesis, not on runtime registration/update.\n\n### POC\n\nAttack: \n(1) stake the minimum to register a validator, submitting a 96-byte `BLSPublicKey` that is not a valid G2 point (arbitrary bytes). Registration succeeds. \n(2) Once the validator is eligible and selected into a consensus group, every in-group node  including the honest leader (`group[0]`)  calls `MultiSigner().Reset(groupPubKeys, selfIndex)` at slot start, which deserializes all group keys via `PublicKeyFromByteArray` \u2192 herumi `Deserialize` **deterministically fails** on the malformed key \u2192 `SetSlotCanceled(true)`. The verify side (`Create(consensusPubKeys)`) fails identically. No block is produced for that round. \n\n\n\n### Impact\n\nEvery consensus round whose group contains the malformed-key validator is a missed slot. One eligible bad-key validator poisons roughly a `groupSize / eligibleSet` fraction of rounds \u2192 sustained liveness degradation. **Where the consensus group equals the eligible set (small or early-stage networks), this is a full chain halt.** Cost is the minimum validator stake, permissionless, and repeatable; no fork flag gates the missing validation. \n\nRated **High** (Byzantine liveness; Critical on small validator sets). The severity scales down to a fractional missed-slot / throughput-degradation attack on a large validator set where the bad validator is only occasionally in the active group.\n\n### Recommendation\n\nEnforce `CheckPublicKeyValid` (curve + prime-order subgroup + non-zero) on the submitted BLS key at runtime validator registration and config-update, and ideally require a proof-of-possession (a BLS signature over the validator\u0027s own key/identity) at registration to prove key ownership and well-formedness. Gate the stricter validation behind an epoch fork flag for reprocessing consistency.",
  "id": "GHSA-9wh6-9hq7-9688",
  "modified": "2026-09-23T21:24:08Z",
  "published": "2026-09-23T21:24:08Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/klever-io/klever-go/security/advisories/GHSA-9wh6-9hq7-9688"
    },
    {
      "type": "WEB",
      "url": "https://github.com/klever-io/klever-go/commit/11606a90ccc289f93d0175994733229b332d9cff"
    },
    {
      "type": "WEB",
      "url": "https://github.com/klever-io/klever-go/commit/642da967893884d635986fed3c43bdc679cbfe8f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/klever-io/klever-go"
    },
    {
      "type": "WEB",
      "url": "https://github.com/klever-io/klever-go/releases/tag/v1.7.20"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Klever-Go: Validator registration accepts an unvalidated BLS public key \u2192 consensus liveness DoS"
}

CVE-2026-82407 (GCVE-0-2026-82407)

Vulnerability from cvelistv5 – Published: 2026-09-23 19:17 – Updated: 2026-09-23 19:42

Title

Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS

Summary

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, core/kapp/validators/validators.go Register and the runtime validator update path accept a submitted BLSPublicKey without curve, prime-order subgroup, or nonzero validation. When a validator with a malformed key becomes eligible and is selected into a consensus group, MultiSigner.Reset and the corresponding signature verification creation path cannot deserialize the group key and cancel the slot. This causes repeated missed rounds and throughput degradation, and a network whose consensus group equals the eligible validator set can halt completely. Genesis validation is not affected because that path already performs CheckPublicKeyValid. This issue is fixed in version 1.7.20.

Severity

7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-23 19:41 UTC

CWE

CWE-20 - Improper Input Validation

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/klever-io/klever-go/security/a…	x_refsource_CONFIRM
https://github.com/klever-io/klever-go/commit/116…	x_refsource_MISC
https://github.com/klever-io/klever-go/commit/642…	x_refsource_MISC
https://github.com/klever-io/klever-go/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
klever-io	klever-go	Affected: < 1.7.20

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-82407",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T19:41:57.322149Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T19:42:17.556Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/klever-io/klever-go/security/advisories/GHSA-9wh6-9hq7-9688"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "klever-go",
          "vendor": "klever-io",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.7.20"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, core/kapp/validators/validators.go Register and the runtime validator update path accept a submitted BLSPublicKey without curve, prime-order subgroup, or nonzero validation. When a validator with a malformed key becomes eligible and is selected into a consensus group, MultiSigner.Reset and the corresponding signature verification creation path cannot deserialize the group key and cancel the slot. This causes repeated missed rounds and throughput degradation, and a network whose consensus group equals the eligible validator set can halt completely. Genesis validation is not affected because that path already performs CheckPublicKeyValid. This issue is fixed in version 1.7.20."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T19:17:59.006Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/klever-io/klever-go/security/advisories/GHSA-9wh6-9hq7-9688",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/klever-io/klever-go/security/advisories/GHSA-9wh6-9hq7-9688"
        },
        {
          "name": "https://github.com/klever-io/klever-go/commit/11606a90ccc289f93d0175994733229b332d9cff",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/klever-io/klever-go/commit/11606a90ccc289f93d0175994733229b332d9cff"
        },
        {
          "name": "https://github.com/klever-io/klever-go/commit/642da967893884d635986fed3c43bdc679cbfe8f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/klever-io/klever-go/commit/642da967893884d635986fed3c43bdc679cbfe8f"
        },
        {
          "name": "https://github.com/klever-io/klever-go/releases/tag/v1.7.20",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/klever-io/klever-go/releases/tag/v1.7.20"
        }
      ],
      "source": {
        "advisory": "GHSA-9wh6-9hq7-9688",
        "discovery": "UNKNOWN"
      },
      "title": "Klever-Go: Validator registration accepts an unvalidated BLS public key \u2192 consensus liveness DoS"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-82407",
    "datePublished": "2026-09-23T19:17:59.006Z",
    "dateReserved": "2026-08-28T22:00:43.513Z",
    "dateUpdated": "2026-09-23T19:42:17.556Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted