GHSA-9WH6-9HQ7-9688
Vulnerability from github – Published: 2026-09-23 21:24 – Updated: 2026-09-23 21:24Location: core/kapp/validators/validators.go:201 (Register), (genesis/checking/nodesSetupChecker.go:73). core/consensus/slot/bls/subslotStartSlot.go:165 core/consensus/.../headerSignatureVerify.go:123 (Create(...)).
Description
Klever uses a BDN (Boneh-Drijvers-Neven) BLS multi-signature over BLS12-381 to finalize blocks (crypto/signing/mcl/multisig/bls.go, herumi/bls-go-binary). The library is initialized with only bls.Init(bls.BLS12_381) and no order-verification flags, so Deserialize does not enforce prime-order-subgroup membership subgroup safety relies on explicit IsValidOrder() calls in the wrappers.
Runtime validator registration (validators.Register) stores the submitted 96-byte BLSPublicKey via SetBLSPublicKey with no curve check, no subgroup check, and no proof-of-possession (CreateValidatorContract carries the key but no signature proving key ownership; grep confirms no proofOfPossession/VerifyProof/BLSSignature verification anywhere in core/kapp/validators/). CheckPublicKeyValid — which does IsValid && IsValidOrder && !IsZero — runs only at genesis, not on runtime registration/update.
POC
Attack:
(1) stake the minimum to register a validator, submitting a 96-byte BLSPublicKey that is not a valid G2 point (arbitrary bytes). Registration succeeds.
(2) Once the validator is eligible and selected into a consensus group, every in-group node including the honest leader (group[0]) calls MultiSigner().Reset(groupPubKeys, selfIndex) at slot start, which deserializes all group keys via PublicKeyFromByteArray → herumi Deserialize deterministically fails on the malformed key → SetSlotCanceled(true). The verify side (Create(consensusPubKeys)) fails identically. No block is produced for that round.
Impact
Every consensus round whose group contains the malformed-key validator is a missed slot. One eligible bad-key validator poisons roughly a groupSize / eligibleSet fraction of rounds → sustained liveness degradation. Where the consensus group equals the eligible set (small or early-stage networks), this is a full chain halt. Cost is the minimum validator stake, permissionless, and repeatable; no fork flag gates the missing validation.
Rated High (Byzantine liveness; Critical on small validator sets). The severity scales down to a fractional missed-slot / throughput-degradation attack on a large validator set where the bad validator is only occasionally in the active group.
Recommendation
Enforce CheckPublicKeyValid (curve + prime-order subgroup + non-zero) on the submitted BLS key at runtime validator registration and config-update, and ideally require a proof-of-possession (a BLS signature over the validator's own key/identity) at registration to prove key ownership and well-formedness. Gate the stricter validation behind an epoch fork flag for reprocessing consistency.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.7.19"
},
"package": {
"ecosystem": "Go",
"name": "github.com/klever-io/klever-go"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.7.20"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-82407"
],
"database_specific": {
"cwe_ids": [
"CWE-20"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-23T21:24:08Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "**Location:** `core/kapp/validators/validators.go:201` (`Register`), (`genesis/checking/nodesSetupChecker.go:73`). `core/consensus/slot/bls/subslotStartSlot.go:165` `core/consensus/.../headerSignatureVerify.go:123` (`Create(...)`).\n\n### Description\n\nKlever uses a BDN (Boneh-Drijvers-Neven) BLS multi-signature over BLS12-381 to finalize blocks (`crypto/signing/mcl/multisig/bls.go`, herumi/bls-go-binary). The library is initialized with only `bls.Init(bls.BLS12_381)` and no order-verification flags, so `Deserialize` does not enforce prime-order-subgroup membership subgroup safety relies on explicit `IsValidOrder()` calls in the wrappers.\n\nRuntime validator registration (`validators.Register`) stores the submitted 96-byte `BLSPublicKey` via `SetBLSPublicKey` with **no curve check, no subgroup check, and no proof-of-possession** (`CreateValidatorContract` carries the key but no signature proving key ownership; grep confirms no `proofOfPossession`/`VerifyProof`/`BLSSignature` verification anywhere in `core/kapp/validators/`). `CheckPublicKeyValid` \u2014 which does `IsValid \u0026\u0026 IsValidOrder \u0026\u0026 !IsZero` \u2014 runs only at genesis, not on runtime registration/update.\n\n### POC\n\nAttack: \n(1) stake the minimum to register a validator, submitting a 96-byte `BLSPublicKey` that is not a valid G2 point (arbitrary bytes). Registration succeeds. \n(2) Once the validator is eligible and selected into a consensus group, every in-group node including the honest leader (`group[0]`) calls `MultiSigner().Reset(groupPubKeys, selfIndex)` at slot start, which deserializes all group keys via `PublicKeyFromByteArray` \u2192 herumi `Deserialize` **deterministically fails** on the malformed key \u2192 `SetSlotCanceled(true)`. The verify side (`Create(consensusPubKeys)`) fails identically. No block is produced for that round. \n\n\n\n### Impact\n\nEvery consensus round whose group contains the malformed-key validator is a missed slot. One eligible bad-key validator poisons roughly a `groupSize / eligibleSet` fraction of rounds \u2192 sustained liveness degradation. **Where the consensus group equals the eligible set (small or early-stage networks), this is a full chain halt.** Cost is the minimum validator stake, permissionless, and repeatable; no fork flag gates the missing validation. \n\nRated **High** (Byzantine liveness; Critical on small validator sets). The severity scales down to a fractional missed-slot / throughput-degradation attack on a large validator set where the bad validator is only occasionally in the active group.\n\n### Recommendation\n\nEnforce `CheckPublicKeyValid` (curve + prime-order subgroup + non-zero) on the submitted BLS key at runtime validator registration and config-update, and ideally require a proof-of-possession (a BLS signature over the validator\u0027s own key/identity) at registration to prove key ownership and well-formedness. Gate the stricter validation behind an epoch fork flag for reprocessing consistency.",
"id": "GHSA-9wh6-9hq7-9688",
"modified": "2026-09-23T21:24:08Z",
"published": "2026-09-23T21:24:08Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/klever-io/klever-go/security/advisories/GHSA-9wh6-9hq7-9688"
},
{
"type": "WEB",
"url": "https://github.com/klever-io/klever-go/commit/11606a90ccc289f93d0175994733229b332d9cff"
},
{
"type": "WEB",
"url": "https://github.com/klever-io/klever-go/commit/642da967893884d635986fed3c43bdc679cbfe8f"
},
{
"type": "PACKAGE",
"url": "https://github.com/klever-io/klever-go"
},
{
"type": "WEB",
"url": "https://github.com/klever-io/klever-go/releases/tag/v1.7.20"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
"type": "CVSS_V4"
}
],
"summary": "Klever-Go: Validator registration accepts an unvalidated BLS public key \u2192 consensus liveness DoS"
}
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.