Skip to content
OpenAdvisories
High · 8.7 CVE-2026-55764 EUVD-2026-68012GHSA-mrpp-v6pg-p54xGO-2026-6330

Klever-Go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply

Published Aug 28, 2026 · Updated Aug 31, 2026 · Assigned by GitHub_M

Description

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, Klever-Go allows a mint-role holder to bypass a finite per-nonce MaxSupply on the semi-fungible token add-quantity path. In core/kapp/systemAccount/systemAcount.go, SFTAddCirculation performed meta.Circulation += amount before evaluating whether Circulation exceeded MaxSupply, without checking for signed int64 overflow. A large positive raw Amount supplied through processSemiFungibleAddQuantity in core/kapp/kda/mint.go can wrap Circulation negative, causing the signed maximum-supply comparison to pass and crediting approximately MaxInt64 units while corrupting the on-chain counter. The fungible path is not affected because its MintedValue <= 0 guard detects the overflow. The correction uses the consensus activation flag FixMarketBuyOverflow. This issue is fixed in version 1.7.19.

Affected products

VendorProductAffectedFixed
klever-io klever-go < 1.7.19 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
SLES for SAP 16.0 govulncheck-vulndb 0.0.20260902T191204-160000.1.1 SUSE-SU-2026:23712-1, SUSE-SU-2026:23692-1
SLES 16.0 govulncheck-vulndb 0.0.20260902T191204-160000.1.1 SUSE-SU-2026:23712-1, SUSE-SU-2026:23692-1
ReleasePackageFixed inAdvisory
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260902T191204-160000.1.1 openSUSE-SU-2026:21812-1

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/klever-io/klever-go < 1.7.19 1.7.19 GHSA-mrpp-v6pg-p54x

Advisories 3

References