HIGH7.0
GO-2026-6586
Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS in github.com/klever-io/klever-go
Quick fix
GO-2026-6586 — github.com/klever-io/klever-go: upgrade to the fixed version with the command below.
go get github.com/klever-io/klever-go@v1.7.20Details
Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS in github.com/klever-io/klever-go
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/klever-io/klever-go
Introduced in:
0Fixed in: 1.7.20Fix
go get github.com/klever-io/klever-go@v1.7.20References
- https://github.com/klever-io/klever-go/security/advisories/GHSA-9wh6-9hq7-9688[ADVISORY]
- https://github.com/klever-io/klever-go/commit/11606a90ccc289f93d0175994733229b332d9cff[FIX]
- https://github.com/klever-io/klever-go/commit/642da967893884d635986fed3c43bdc679cbfe8f[FIX]
- https://github.com/klever-io/klever-go/releases/tag/v1.7.20[WEB]