High 8.7Published Aug 28, 2026

CVE-2026-55763Klever-Go: Percentage-transfer royalty skips the source debit at exactly-100% splits

Updated under an hour ago (2026-10-19 08:23 UTC)

Does this affect you?

It affects klever-io klever-go. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for klever-io klever-go

Exploited in the last 30 days

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, processPercentageRoyaltiesTransfer in core/kapp/accounts/accounts.go calls SubFromBalance after the split loop and after the royaltiesToPay <= 0 early return. computeSplitRoyalties rejects only when splitToPay > royaltiesToPay, so a valid PercentTransferPercentage = 10000 split consumes exactly 100 percent of the royalty pool, sets royaltiesToPay to zero, and returns before the source account is debited. The split recipient receives the full royaltyAmount while the sender pays nothing and the supply counter is not updated, allowing unbounded off-the-books inflation of the transferred KDA. A KDA owner must configure a TransferPercentage royalty with a 100 percent split, after which any holder's transfer of the asset triggers the mint; the sibling processFixedRoyaltiesTransfer path is not affected because it debits the source before distribution. This issue is fixed in version 1.7.19.

CVSS: 8.7 HIGH (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness (CWE): CWE-841
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: GitHub_M
NVD analysis: Deferred
Record last updated: Aug 31, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

klever-io klever-go klever_io:klever_go (from the name)	before 1.7.19	CNA record

References

https://github.com/klever-io/klever-go/security/advisories/GHSA-v358-wf77-39xvx-refsource-confirm
https://github.com/klever-io/klever-go/commit/8bcc600b0ac88070740c63c7ce1c8a968dd85251x-refsource-misc
https://github.com/klever-io/klever-go/releases/tag/v1.7.19x-refsource-misc

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.