Validations for BLS public keys are omitted during validator registration and runtime update in Klever-Go, allowing a malicious validator to submit a malformed key. When such a validator is chosen into a consensus group, the group key cannot be deserialized, causing the validator to cancel its slot and triggering repeated missed rounds. This degradation of throughput can escalated to a network halt if the consensus group equals the eligible validator set. The flaw is a classic input validation failure (CWE-20) impacting availability, not confidentiality or integrity.

All versions of Klever-Go prior to release 1.7.20 are affected. The vulnerability applies to the validator registration and runtime update paths in the core/kapp/validators/validators.go module, while genesis validation remains safe because it already checks key validity.

The vulnerability carries a CVSS score of 7, indicating a high severity. EPSS data is not available, and the issue is not listed in the CISA KEV catalog. The likely attack vector requires an actor to register or update a validator with a malformed BLS key, which then becomes eligible for consensus participation. If successfully leveraged, the attacker can cause repeated consensus failures, degrade performance, and potentially bring the network to a standstill.