CVE-2026-55764: CVE-2026-55764: Integer Overflow in SFT Circulation Counter in Klever-Go

#security #cve #cybersecurity

CVE-2026-55764: Integer Overflow in SFT Circulation Counter in Klever-Go

Vulnerability ID: CVE-2026-55764
CVSS Score: 8.7
Published: 2026-08-28

An integer overflow vulnerability (CWE-190) exists in klever-go, the Go implementation of the Klever blockchain protocol, within the Semi-Fungible Token (SFT) addition path. An attacker with a mint role can exploit this by passing an extremely large positive value when adding SFT quantity, which overflows a signed 64-bit integer. This bypasses the maximum supply checks and allows minting arbitrary tokens while corrupting the state.

TL;DR

Integer overflow in SFT Add Quantity path allows minting beyond MaxSupply limit.

Technical Details

CWE ID: CWE-190
Attack Vector: Network (N)
CVSS v4.0: 8.7
EPSS Score: 0.00323 (0.32%)
Impact: High Availability Impact (corrupted state-trie storage, concurrent read/write crashes)
Exploit Status: POC (Available in public patches and unit tests)
KEV Status: Not Listed

Affected Systems

klever-go
klever-go: < 1.7.19 (Fixed in: 1.7.19)

Code Analysis

Commit: 8bcc600

Introduce SFT circulation overflow check and uncached state retrieval methods to fix market buy overflow and avoid concurrent read/write map crashes.

Mitigation Strategies

Upgrade klever-go to version 1.7.19 or higher.
Ensure consensus activation epoch flags for 'fixMarketBuyOverflow' are configured correctly in enableEpochs.yaml.

Remediation Steps:

Deploy the v1.7.19 binary to all validators.
Configure enableEpochs.yaml with the target activation epoch for fixMarketBuyOverflow.
Monitor node synchronization and state transition consistency.

References

Read the full report for CVE-2026-55764 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community