https://vulnerability.circl.lu/sightings/feed 2026-08-30T22:29:08.891986+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/0f2fa91f-5820-4062-8419-8c2ff175033f/export 2026-08-30T22:29:08.921360+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "0f2fa91f-5820-4062-8419-8c2ff175033f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55764", "type": "seen", "source": "https://gist.github.com/alon710/a4189f000966d11dd547e0bc128cf503", "content": "# CVE-2026-55764: CVE-2026-55764: Integer Overflow in SFT Circulation Counter in Klever-Go\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-08-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55764\n\n## Summary\nAn integer overflow vulnerability (CWE-190) exists in klever-go, the Go implementation of the Klever blockchain protocol, within the Semi-Fungible Token (SFT) addition path. An attacker with a mint role can exploit this by passing an extremely large positive value when adding SFT quantity, which overflows a signed 64-bit integer. This bypasses the maximum supply checks and allows minting arbitrary tokens while corrupting the state.\n\n## TL;DR\nInteger overflow in SFT Add Quantity path allows minting beyond MaxSupply limit.\n\n## Technical Details\n\n- **CWE ID**: CWE-190\n- **Attack Vector**: Network (N)\n- **CVSS v4.0**: 8.7\n- **EPSS Score**: 0.00323 (0.32%)\n- **Impact**: High Availability Impact (corrupted state-trie storage, concurrent read/write crashes)\n- **Exploit Status**: POC (Available in public patches and unit tests)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- klever-go\n- **klever-go**: < 1.7.19 (Fixed in: `1.7.19`)\n\n## Mitigation\n\n- Upgrade klever-go to version 1.7.19 or higher.\n- Ensure consensus activation epoch flags for 'fixMarketBuyOverflow' are configured correctly in enableEpochs.yaml.\n\n**Remediation Steps:**\n1. Deploy the v1.7.19 binary to all validators.\n2. Configure enableEpochs.yaml with the target activation epoch for fixMarketBuyOverflow.\n3. Monitor node synchronization and state transition consistency.\n\n## References\n\n- [GitHub Security Advisory](https://github.com/klever-io/klever-go/security/advisories/GHSA-mrpp-v6pg-p54x)\n- [GitHub Fix Commit](https://github.com/klever-io/klever-go/commit/8bcc600b0ac88070740c63c7ce1c8a968dd85251)\n- [Klever-Go v1.7.19 Release](https://github.com/klever-io/klever-go/releases/tag/v1.7.19)\n- [NVD Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-55764)\n- [CVE.org Authoritative Record](https://www.cve.org/CVERecord?id=CVE-2026-55764)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55764) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-29T15:32:25.794307Z"} 2026-08-29T15:32:25.794307+00:00 https://vulnerability.circl.lu/sighting/40e47260-77a3-4b33-bcbe-8d48e9b30523/export 2026-08-30T22:29:08.924577+00:00 Joseph Lee https://vulnerability.circl.lu/user/syspect {"uuid": "40e47260-77a3-4b33-bcbe-8d48e9b30523", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-55764", "type": "published-proof-of-concept", "source": "https://github.com/klever-io/klever-go/security/advisories/GHSA-mrpp-v6pg-p54x", "content": "", "creation_timestamp": "2026-08-29T00:35:10.301484Z"} 2026-08-29T00:35:10.301484+00:00 https://vulnerability.circl.lu/sighting/dbab7a72-a0d9-4dc4-a3ee-f0381c23e6be/export 2026-08-30T22:29:08.926358+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "dbab7a72-a0d9-4dc4-a3ee-f0381c23e6be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55764", "type": "seen", "source": "https://bsky.app/profile/thestandup.bsky.social/post/3mu6fgkg5uk2x", "content": "klever-go advisory CVE-2026-55764: SFTAddCirculation does meta.Circulation += amount with no overflow guard, then checks Circulation > MaxSupply. A wrapped-negative int64 passes that cap, so a nonce capped at 1000 mints to ~MaxInt64. #dev", "creation_timestamp": "2026-08-28T22:19:37.787236Z"} 2026-08-28T22:19:37.787236+00:00