Description
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, Klever-Go allows a mint-role holder to bypass a finite per-nonce MaxSupply on the semi-fungible token add-quantity path. In core/kapp/systemAccount/systemAcount.go, SFTAddCirculation performed meta.Circulation += amount before evaluating whether Circulation exceeded MaxSupply, without checking for signed int64 overflow. A large positive raw Amount supplied through processSemiFungibleAddQuantity in core/kapp/kda/mint.go can wrap Circulation negative, causing the signed maximum-supply comparison to pass and crediting approximately MaxInt64 units while corrupting the on-chain counter. The fungible path is not affected because its MintedValue <= 0 guard detects the overflow. The correction uses the consensus activation flag FixMarketBuyOverflow. This issue is fixed in version 1.7.19.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| klever-io | klever-go | < 1.7.19 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | govulncheck-vulndb | 0.0.20260902T191204-160000.1.1 | SUSE-SU-2026:23712-1, SUSE-SU-2026:23692-1 |
| SLES 16.0 | govulncheck-vulndb | 0.0.20260902T191204-160000.1.1 | SUSE-SU-2026:23712-1, SUSE-SU-2026:23692-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260902T191204-160000.1.1 | openSUSE-SU-2026:21812-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/klever-io/klever-go | < 1.7.19 | 1.7.19 | GHSA-mrpp-v6pg-p54x |
Advisories 3
- SUSE-SU-2026:23692-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Sep 29, 2026
- SUSE-SU-2026:23712-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Sep 29, 2026
- openSUSE-SU-2026:21812-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Sep 10, 2026