Is CVE-2026-55764 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55764 being exploited in the wild.

How severe is CVE-2026-55764?

High severity, with a CVSS score of 4, published 28 August 2026.

Which products and versions are affected?

github.com/klever-io/klever-go (Go) < 1.7.19, SEMVER:introduced=0,fixed=1.7.19; Klever.io Klever-Go < 1.7.19.

Is there a fix for CVE-2026-55764?

Yes. github.com/klever-io/klever-go (Go): upgrade to 1.7.19 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55764 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-55764?

Check whether you run github.com/klever-io/klever-go (Go) or Klever.io Klever-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55764: klever-go SFT add-quantity int64 overflow bypasses MaxSupply

Q: Is there a fix for CVE-2026-55764?

Yes. github.com/klever-io/klever-go (Go): upgrade to 1.7.19 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-55764 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-55764?

Check whether you run github.com/klever-io/klever-go (Go) or Klever.io Klever-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55764 · Severity: high · CVSS 4 · Published 2026-08-28

The Klever blockchain library's semi-fungible token (SFT) minting function fails to validate integer overflow when adding tokens to circulation. A mint-role holder can mint approximately 9.2 quintillion tokens in a single transaction, bypassing a declared supply cap and corrupting the on-chain circulation counter. This allows unauthorized token creation at massive scale with no corresponding debit.

Technologies: github.com/klever-io/klever-go (Go), Klever.io Klever-Go. Vendors: Go, Klever.io.

Quick answers

Is CVE-2026-55764 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55764 being exploited in the wild.
How severe is CVE-2026-55764?: High severity, with a CVSS score of 4, published 28 August 2026.
Which products and versions are affected?: github.com/klever-io/klever-go (Go) < 1.7.19, SEMVER:introduced=0,fixed=1.7.19; Klever.io Klever-Go < 1.7.19.
Is there a fix for CVE-2026-55764?: Yes. github.com/klever-io/klever-go (Go): upgrade to 1.7.19 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55764 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-55764?: Check whether you run github.com/klever-io/klever-go (Go) or Klever.io Klever-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/klever-io/klever-go (Go): upgrade to 1.7.19 or later
```
go get github.com/klever-io/klever-go@v1.7.19
```

Technical details

The vulnerability is an integer overflow in the SFTAddCirculation function (core/kapp/systemAccount/systemAcount.go:132-138). The code performs an unguarded addition `meta.Circulation += amount` where amount is a raw int64 parameter from the contract with no upstream bounds. When amount is large enough (e.g., MaxInt64), the addition overflows and wraps to a negative value. The subsequent cap check `if meta.Circulation > meta.MaxSupply && meta.MaxSupply != 0` evaluates to false because a negative number is not greater than MaxSupply, allowing the function to return nil and persist the corrupted circulation value. The fungible mint path is protected by a post-increment `MintedValue <= 0` guard that this code path lacks. Attack vector is network-based; requires mint-role holder authorization (asset owner or delegated role). A proof-of-concept unit test confirms the overflow and bypass, and live on-chain testing demonstrates minting MaxInt64 tokens past a declared cap of 1000 with result code Ok.

Affected products

klever-io klever-go < 1.7.19

Identifiers

CVE-2026-55764
GHSA-mrpp-v6pg-p54x
GO-2026-6330

Timeline

2026-06-22: disclosed
2026-06-22: patched: Fixed in version 1.7.19
2026-08-28: other: CVE-2026-55764 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.