Read the docs
TI-2026-39561 Aliases CVE-2026-54755GHSA-cgc5-v3f2-8m2v

Klever-Go: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token)

Priority MEDIUM 42CWE-190Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, split-royalty fields decoded in core/kapp/builtInFunctions/utils.go can contain values greater than core.HundredPercent, and core/kapp/kda/create.go and core/kapp/kda/trigger.go sum those values in uint32 accumulators. Crafted values such as two 0x80000000 entries wrap the validation sum to zero and pass CheckValid100Params. Royalty payout paths in core/kapp/accounts/accounts.go, core/kapp/market/market.go, and core/kapp/ito/ito.go then credit each oversized split amount and silently discard a negative remainder, allowing ordinary asset transfers, marketplace purchases, or ITO purchases to create unbacked KLV or other assets. This issue is fixed in version 1.7.19.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0056 46th percentileScored 2026-11-07
Fix Fixed klever-go (klever-io): 1.7.19github.com/klever-io/klever-go (Go): 1.7.19

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
klever-ioklever-gobefore 1.7.191.7.19Patch availableCNA
—github.com/klever-io/klever-go (Go)before 1.7.191.7.19Patch availableGHSA-cgc5-v3f2-8m2v
  • klever-go Vendorklever-io Affected before 1.7.19 Fixed in 1.7.19 Patch available CNA
  • github.com/klever-io/klever-go (Go) Vendor— Affected before 1.7.19 Fixed in 1.7.19 Patch available GHSA-cgc5-v3f2-8m2v

Remediation

  • Fix · CNA klever-go (klever-io) Fixed in 1.7.19
  • Fix · GHSA-cgc5-v3f2-8m2v github.com/klever-io/klever-go (Go) Fixed in 1.7.19 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54755
  2. 2026-10-03 Alias added: GHSA-cgc5-v3f2-8m2v

References

Other 4

  • TI-2026-40253 Klever-Go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply CVSS 4.0HIGH 8.7
  • TI-2026-40252 Klever-Go: Percentage-transfer royalty skips the source debit at exactly-100% splits CVSS 4.0HIGH 8.7
  • TI-2026-58874 Klever-Go: /log controls global node logging CVSS 3.1HIGH 8.6
  • TI-2026-32588 Klever-Go MultiDataInterceptor: remote OOM via crafted compressed P2P payload CVSS 3.1HIGH 8.6
  • TI-2026-39560 Integer underflow in klever-io klever-go CVSS 3.1CRITICAL 9.6
  • TI-2026-58875 Resource allocation without limits in klever-io klever-go CVSS 3.1HIGH 7.5
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences