CVE-2026-55764

Received Received - Intake

Integer Overflow in Klever-Go SFT Circulation

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: GitHub, Inc.

Description

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, Klever-Go allows a mint-role holder to bypass a finite per-nonce MaxSupply on the semi-fungible token add-quantity path. In core/kapp/systemAccount/systemAcount.go, SFTAddCirculation performed meta.Circulation += amount before evaluating whether Circulation exceeded MaxSupply, without checking for signed int64 overflow. A large positive raw Amount supplied through processSemiFungibleAddQuantity in core/kapp/kda/mint.go can wrap Circulation negative, causing the signed maximum-supply comparison to pass and crediting approximately MaxInt64 units while corrupting the on-chain counter. The fungible path is not affected because its MintedValue <= 0 guard detects the overflow. The correction uses the consensus activation flag FixMarketBuyOverflow. This issue is fixed in version 1.7.19.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-55764

Affected Vendors & Products

Vendor	Product	Version / Range
klever	klever-go	1.7.19

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

Executive Summary

This vulnerability in Klever-Go allows a mint-role holder to bypass the maximum supply limit for semi-fungible tokens by exploiting integer overflow. The system fails to check for overflow before adding a large amount to the token circulation counter, causing it to wrap around to a negative value and pass the supply check.

Detection Guidance

This vulnerability is specific to the Klever-Go blockchain implementation and requires checking for version mismatches or anomalous token supply values. No direct network or system commands are provided in the context to detect this issue. Review the Klever-Go version installed and compare it against 1.7.19. Inspect on-chain token supply records for unexpected large increases in semi-fungible token circulation.

Impact Analysis

An attacker with mint privileges could create an excessive number of tokens, corrupting the on-chain supply counter and potentially devaluing existing tokens. This could lead to financial losses or disruption of the blockchain network.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as described. The issue involves a blockchain protocol's minting mechanism allowing unauthorized token supply increases, which could impact financial integrity but does not explicitly violate data protection or privacy regulations.

Mitigation Strategies

Immediately upgrade Klever-Go to version 1.7.19 or later to address the signed int64 overflow issue in SFTAddCirculation. Ensure the FixMarketBuyOverflow consensus activation flag is enabled to prevent the vulnerability.

Hi! I’m here to help you understand CVE-2026-55764. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70