Read the docs
TI-2026-40253 Aliases CVE-2026-55764GHSA-mrpp-v6pg-p54x

Klever-Go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply

Priority HIGH 77CWE-190Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-190 and the CVSS impact.

Summary

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, Klever-Go allows a mint-role holder to bypass a finite per-nonce MaxSupply on the semi-fungible token add-quantity path. In core/kapp/systemAccount/systemAcount.go, SFTAddCirculation performed meta.Circulation += amount before evaluating whether Circulation exceeded MaxSupply, without checking for signed int64 overflow. A large positive raw Amount supplied through processSemiFungibleAddQuantity in core/kapp/kda/mint.go can wrap Circulation negative, causing the signed maximum-supply comparison to pass and crediting approximately MaxInt64 units while corrupting the on-chain counter. The fungible path is not affected because its MintedValue <= 0 guard detects the overflow. The correction uses the consensus activation flag FixMarketBuyOverflow. This issue is fixed in version 1.7.19.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00538 45th percentileScored 2026-11-07
Fix Fixed klever-go (klever-io): 1.7.19github.com/klever-io/klever-go (Go): 1.7.19

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
klever-ioklever-gobefore 1.7.191.7.19Patch availableCNA
—github.com/klever-io/klever-go (Go)before 1.7.191.7.19Patch availableGHSA-mrpp-v6pg-p54x
  • klever-go Vendorklever-io Affected before 1.7.19 Fixed in 1.7.19 Patch available CNA
  • github.com/klever-io/klever-go (Go) Vendor— Affected before 1.7.19 Fixed in 1.7.19 Patch available GHSA-mrpp-v6pg-p54x

Remediation

  • Fix · CNA klever-go (klever-io) Fixed in 1.7.19
  • Fix · GHSA-mrpp-v6pg-p54x github.com/klever-io/klever-go (Go) Fixed in 1.7.19 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55764
  2. 2026-10-03 Alias added: GHSA-mrpp-v6pg-p54x

References

Other 4

  • TI-2026-40252 Klever-Go: Percentage-transfer royalty skips the source debit at exactly-100% splits CVSS 4.0HIGH 8.7
  • TI-2026-58874 Klever-Go: /log controls global node logging CVSS 3.1HIGH 8.6
  • TI-2026-32588 Klever-Go MultiDataInterceptor: remote OOM via crafted compressed P2P payload CVSS 3.1HIGH 8.6
  • TI-2026-39560 Integer underflow in klever-io klever-go CVSS 3.1CRITICAL 9.6
  • TI-2026-58875 Resource allocation without limits in klever-io klever-go CVSS 3.1HIGH 7.5
  • TI-2026-37979 Klever-Go: REST API slow-header connection exhaustion via Gin Engine.Run CVSS 3.1HIGH 7.5
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences