CVE-2026-55764

Name of the Vulnerable Software and Affected Versions Klever-Go versions prior to 1.7.19

Description Klever-Go, a Go implementation of the Klever blockchain protocol, contains an integer overflow issue in the semi-fungible token (SFT) add-quantity path. In the SFTAddCirculation() function within core/kapp/systemAccount/systemAcount.go, the software increments the meta.Circulation variable by a provided amount without an overflow guard. A mint-role holder can provide a large positive amount via the processSemiFungibleAddQuantity() function in core/kapp/kda/mint.go that causes the signed int64 value of meta.Circulation to wrap around to a negative number. Because the subsequent check only verifies if the circulation exceeds meta.MaxSupply, a negative value allows the check to pass, enabling the minting of approximately MaxInt64 units and corrupting the on-chain circulation counter. This issue does not affect the fungible path as it includes a guard that detects such overflows.

Recommendations Update to version 1.7.19. As a temporary mitigation, restrict the minting privileges of mint-role holders to prevent the submission of excessively large amount values in SFT transactions.