Read the docs
TI-2026-39560 Aliases CVE-2026-54754GHSA-p7gw-2pcp-5pf8

Integer underflow in klever-io klever-go

Priority HIGH 74CWE-191Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, marketplace settlement in core/kapp/market/market.go reads MarketOrderData.ReferralPercentage from the listing while reading asset.Royalties.MarketPercentage live at purchase time. An asset owner can create a valid listing and then use AssetTrigger UpdateRoyalties to make the combined referral and royalty percentages exceed the bid. executeBuyMarket pays referral and royalty amounts unconditionally while computeMarketOwnerAmount silently skips a nonpositive seller remainder, allowing MarketBuy, BuyItNow, or auction Claim settlement to credit more KLV or sale currency than the buyer paid. This can create unbacked currency and corrupt token supply integrity. This issue is fixed in version 1.7.19.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00432 37th percentileScored 2026-11-07
Fix Fixed klever-go (klever-io): 1.7.19github.com/klever-io/klever-go (Go): 1.7.19

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
klever-ioklever-gobefore 1.7.191.7.19Patch availableCNA
—github.com/klever-io/klever-go (Go)before 1.7.191.7.19Patch availableGHSA-p7gw-2pcp-5pf8
  • klever-go Vendorklever-io Affected before 1.7.19 Fixed in 1.7.19 Patch available CNA
  • github.com/klever-io/klever-go (Go) Vendor— Affected before 1.7.19 Fixed in 1.7.19 Patch available GHSA-p7gw-2pcp-5pf8

Remediation

  • Fix · CNA klever-go (klever-io) Fixed in 1.7.19
  • Fix · GHSA-p7gw-2pcp-5pf8 github.com/klever-io/klever-go (Go) Fixed in 1.7.19 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54754
  2. 2026-10-03 Alias added: GHSA-p7gw-2pcp-5pf8

References

Other 4

  • TI-2026-40253 Klever-Go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply CVSS 4.0HIGH 8.7
  • TI-2026-40252 Klever-Go: Percentage-transfer royalty skips the source debit at exactly-100% splits CVSS 4.0HIGH 8.7
  • TI-2026-58874 Klever-Go: /log controls global node logging CVSS 3.1HIGH 8.6
  • TI-2026-32588 Klever-Go MultiDataInterceptor: remote OOM via crafted compressed P2P payload CVSS 3.1HIGH 8.6
  • TI-2026-58875 Resource allocation without limits in klever-io klever-go CVSS 3.1HIGH 7.5
  • TI-2026-37979 Klever-Go: REST API slow-header connection exhaustion via Gin Engine.Run CVSS 3.1HIGH 7.5
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences