CVE-2026-82407: Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS
Location: core/kapp/validators/validators.go:201 (Register), (genesis/checking/nodesSetupChecker.go:73). core/consensus/slot/bls/subslotStartSlot.go:165 core/consensus/.../headerSignatureVerify.go:123 (Create(...)).
References
- github.com/advisories/GHSA-9wh6-9hq7-9688
- github.com/klever-io/klever-go/commit/11606a90ccc289f93d0175994733229b332d9cff
- github.com/klever-io/klever-go/commit/642da967893884d635986fed3c43bdc679cbfe8f
- github.com/klever-io/klever-go/releases/tag/v1.7.20
- github.com/klever-io/klever-go/security/advisories/GHSA-9wh6-9hq7-9688
- nvd.nist.gov/vuln/detail/CVE-2026-82407
Code Behaviors & Features
Detect and mitigate CVE-2026-82407 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →