CVE-2026-54755: critical vulnerability in klever-io klever-go
Klever-Go: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token)
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.6epss 0.6%
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, split-royalty fields decoded in core/kapp/builtInFunctions/utils.go can contain values greater than core.HundredPercent, and core/kapp/kda/create.go and core/kapp/kda/trigger.go sum those values in uint32 accumulators. Crafted values such as two 0x80000000 entries wrap the validation sum to zero and pass CheckValid100Params. Royalty payout paths in core/kapp/accounts/accounts.go, core/kapp/market/market.go, and core/kapp/ito/ito.go then credit each oversized split amount and silently discard a negative remainder, allowing ordinary asset transfers, marketplace purchases, or ITO purchases to create unbacked KLV or other assets. This issue is fixed in version 1.7.19.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
Affected products
klever-io · klever-goRelated CVEs — klever-io klever-go
In the same product, most dangerous first.
CVE-2026-86064HIGHKlever-Go: /log controls global node loggingEPSS 0.6%CVE-2026-55764HIGHKlever-Go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupplyEPSS 0.5%CVE-2026-55763HIGHKlever-Go: Percentage-transfer royalty skips the source debit at exactly-100% splitsEPSS 0.5%CVE-2026-52880HIGHKlever-Go: REST API slow-header connection exhaustion via Gin Engine.RunEPSS 0.5%CVE-2026-52879HIGHKlever-Go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoSEPSS 0.5%CVE-2026-52878HIGHKlever-Go: Unauthenticated nil-pointer DoS in P2P transaction validation can halt the chainEPSS 0.5%