{"vulnerability": "ghsa-mrpp-v6pg-p54x", "sightings": [{"uuid": "0918cb46-d84f-486d-bab1-3a8b98f16b19", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-mrpp-v6pg-p54x", "type": "seen", "source": "https://bsky.app/profile/thestandup.bsky.social/post/3mu6fgl7bp42g", "content": "https://github.com/advisories/GHSA-mrpp-v6pg-p54x\nmore like this: https://standup.kynth.studio/sb", "creation_timestamp": "2026-08-28T22:19:38.324607Z"}, {"uuid": "af104a10-5498-49c6-88c9-b6fc0f44b1f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-mrpp-v6pg-p54x", "type": "seen", "source": "https://gist.github.com/alon710/a4189f000966d11dd547e0bc128cf503", "content": "# CVE-2026-55764: CVE-2026-55764: Integer Overflow in SFT Circulation Counter in Klever-Go\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-08-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55764\n\n## Summary\nAn integer overflow vulnerability (CWE-190) exists in klever-go, the Go implementation of the Klever blockchain protocol, within the Semi-Fungible Token (SFT) addition path. An attacker with a mint role can exploit this by passing an extremely large positive value when adding SFT quantity, which overflows a signed 64-bit integer. This bypasses the maximum supply checks and allows minting arbitrary tokens while corrupting the state.\n\n## TL;DR\nInteger overflow in SFT Add Quantity path allows minting beyond MaxSupply limit.\n\n## Technical Details\n\n- **CWE ID**: CWE-190\n- **Attack Vector**: Network (N)\n- **CVSS v4.0**: 8.7\n- **EPSS Score**: 0.00323 (0.32%)\n- **Impact**: High Availability Impact (corrupted state-trie storage, concurrent read/write crashes)\n- **Exploit Status**: POC (Available in public patches and unit tests)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- klever-go\n- **klever-go**: < 1.7.19 (Fixed in: `1.7.19`)\n\n## Mitigation\n\n- Upgrade klever-go to version 1.7.19 or higher.\n- Ensure consensus activation epoch flags for 'fixMarketBuyOverflow' are configured correctly in enableEpochs.yaml.\n\n**Remediation Steps:**\n1. Deploy the v1.7.19 binary to all validators.\n2. Configure enableEpochs.yaml with the target activation epoch for fixMarketBuyOverflow.\n3. Monitor node synchronization and state transition consistency.\n\n## References\n\n- [GitHub Security Advisory](https://github.com/klever-io/klever-go/security/advisories/GHSA-mrpp-v6pg-p54x)\n- [GitHub Fix Commit](https://github.com/klever-io/klever-go/commit/8bcc600b0ac88070740c63c7ce1c8a968dd85251)\n- [Klever-Go v1.7.19 Release](https://github.com/klever-io/klever-go/releases/tag/v1.7.19)\n- [NVD Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-55764)\n- [CVE.org Authoritative Record](https://www.cve.org/CVERecord?id=CVE-2026-55764)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55764) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-29T15:32:25.745682Z"}]}