CVE-2026-55763

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, processPercentageRoyaltiesTransfer in core/kapp/accounts/accounts.go calls SubFromBalance after the split loop and after the royaltiesToPay <= 0 early return. computeSplitRoyalties rejects only when splitToPay > royaltiesToPay, so a valid PercentTransferPercentage = 10000 split consumes exactly 100 percent of the royalty pool, sets royaltiesToPay to zero, and returns before the source account is debited. The split recipient receives the full royaltyAmount while the sender pays nothing and the supply counter is not updated, allowing unbounded off-the-books inflation of the transferred KDA. A KDA owner must configure a TransferPercentage royalty with a 100 percent split, after which any holder's transfer of the asset triggers the mint; the sibling processFixedRoyaltiesTransfer path is not affected because it debits the source before distribution. This issue is fixed in version 1.7.19.

• CWE-841

• https://github.com/klever-io/klever-go/commit/8bcc600b0ac88070740c63c7ce1c8a968dd85251
• https://github.com/klever-io/klever-go/releases/tag/v1.7.19
• https://github.com/klever-io/klever-go/security/advisories/GHSA-v358-wf77-39xv
• https://github.com/klever-io/klever-go/security/advisories/GHSA-v358-wf77-39xv

Published

Aug 28, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55758CC: Tweaked is a mod for Minecraft which adds programmable c…6.9
• CVE-2026-55759Rocket.Chat is an open-source, secure, fully customizable co…7.4
• CVE-2026-5576A flaw has been found in SourceCodester/jkev Record Manageme…4.7
• CVE-2026-55760Handlebars.java provides logic-less and semantic Mustache te…7.5
• CVE-2026-55761Portainer Community Edition is a lightweight service deliver…5.9
• CVE-2026-55762Rocket.Chat is an open-source, secure, fully customizable co…8.1
• CVE-2026-55764Klever-Go is the Go implementation of the Klever blockchain …8.7
• CVE-2026-55765CloudNativePG is a platform designed to manage PostgreSQL da…8.5
• CVE-2026-55766guzzlehttp/psr7 is a PSR-7 HTTP message library implementati…4.8
• CVE-2026-55767Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, Co…5.8
• CVE-2026-55768GoAccess is a real-time web log analyzer and interactive vie…8.7
• CVE-2026-55769CloudNativePG is a platform designed to manage PostgreSQL da…9.4