CVE-2026-58262

The record

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, header signature verification counts the unused padding bits of the PubKeysBitmap toward the two-thirds validator quorum. These padding bits do not correspond to any validator and are ignored by the actual BLS aggregate-signature check, so a malicious or compromised block producer can set them to reach the required quorum while gathering fewer genuine validator signatures than the protocol demands. As a result, nodes that import or intercept the header accept it as correctly signed without a real two-thirds quorum, weakening consensus safety and undermining finality. This issue is fixed in version 1.7.20.

Affected packages

Related vulnerabilities

• CVE-2026-102682 Pipecat is an open-source Python framework for building real-time voice and multimodal… CWE-345
• CVE-2026-104850 MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and… CWE-345
• CVE-2026-102275 PyJWT is a Python implementation of JSON Web Token standards. CWE-345
• CVE-2026-102267 PyJWT is a Python implementation of JSON Web Token standards. CWE-345
• CVE-2026-19941 An inapplicable NSEC record may be accepted by a `named` resolver as proof that no… CWE-345
• CVE-2026-77955 In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD… CWE-345
• CVE-2026-89251 AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ad… CWE-345
• CVE-2026-86809 The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the… CWE-345