{"id":"CVE-2026-54755","title":"Klever-Go is the Go implementation of the Klever blockchain protocol","summary":"Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, split-royalty fields decoded in core/kapp/builtInFunctions/utils.go can contain values greater than core.HundredPercent, and core/kapp/kda/create.go a…","severity":"critical","cvss":9.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H","cwe":["CWE-190"],"vendor":"klever-io","product":"github.com/klever-io/klever-go","affected":["github.com/klever-io/klever-go < 1.7.19"],"patched":["github.com/klever-io/klever-go 1.7.19"],"published":"2026-08-28","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:09:13.080","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54755","references":[{"url":"https://github.com/klever-io/klever-go/commit/8bcc600b0ac88070740c63c7ce1c8a968dd85251","label":"security-advisories@github.com"},{"url":"https://github.com/klever-io/klever-go/releases/tag/v1.7.19","label":"security-advisories@github.com"},{"url":"https://github.com/klever-io/klever-go/security/advisories/GHSA-cgc5-v3f2-8m2v","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-cgc5-v3f2-8m2v"}],"tags":["nvd","ghsa","go"],"epss":0.0056,"epssPercentile":0.44189,"aliases":["GHSA-cgc5-v3f2-8m2v"],"ecosystem":"go","ingestedAt":"2026-08-28T17:22:57.146Z","slug":"CVE-2026-54755","body":"## Overview\n\nKlever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, split-royalty fields decoded in core/kapp/builtInFunctions/utils.go can contain values greater than core.HundredPercent, and core/kapp/kda/create.go and core/kapp/kda/trigger.go sum those values in uint32 accumulators. Crafted values such as two 0x80000000 entries wrap the validation sum to zero and pass CheckValid100Params. Royalty payout paths in core/kapp/accounts/accounts.go, core/kapp/market/market.go, and core/kapp/ito/ito.go then credit each oversized split amount and silently discard a negative remainder, allowing ordinary asset transfers, marketplace purchases, or ITO purchases to create unbacked KLV or other assets. This issue is fixed in version 1.7.19.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-54755)\n\nAffected packages:\n\n- `github.com/klever-io/klever-go < 1.7.19`\n\nPatched in:\n\n- `github.com/klever-io/klever-go 1.7.19`\n\nSource: https://github.com/advisories/GHSA-cgc5-v3f2-8m2v","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":52.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}