CVE-2026-55764High▾ TwilightKlever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, Klever-Go allows a mint-role holder to bypass a finite per-nonce MaxSupply on the semi-fungible token add-quantity path. In core/kapp/systemAccount/sy…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, Klever-Go allows a mint-role holder to bypass a finite per-nonce MaxSupply on the semi-fungible token add-quantity path. In core/kapp/systemAccount/systemAcount.go, SFTAddCirculation performed meta.Circulation += amount before evaluating whether Circulation exceeded MaxSupply, without checking for signed int64 overflow. A large positive raw Amount supplied through processSemiFungibleAddQuantity in core/kapp/kda/mint.go can wrap Circulation negative, causing the signed maximum-supply comparison to pass and crediting approximately MaxInt64 units while corrupting the on-chain counter. The fungible path is not affected because its MintedValue <= 0 guard detects the overflow. The correction uses the consensus activation flag FixMarketBuyOverflow. This issue is fixed in version 1.7.19.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/klever-io/klever-go < 1.7.19Patched in:
github.com/klever-io/klever-go 1.7.19Connected by shared product, vendor, weakness, or advisory.
CVE-2026-54755Critical· 9.6Klever-Go is the Go implementation of the Klever blockchain protocol
CVE-2026-55763HighKlever-Go is the Go implementation of the Klever blockchain protocol
CVE-2026-54754Critical· 9.6Klever-Go is the Go implementation of the Klever blockchain protocol
CVE-2026-44697High· 8.6Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payload
CVE-2026-43618High· 8.1Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receive…
CVE-2026-5121High· 7.5A flaw was found in libarchive