Klever Go Package Vulnerability: Integer Overflow in Split-Royalty Validation
- Severity
- HIGH
- Affected component
- klever-go (go)
- Affected versions
- < 1.7.19
- Patched version
- Not yet available
An integer overflow vulnerability has been reported in the Klever Go package, specifically in the split-royalty validation. This vulnerability may enable unbounded minting of KLV tokens.
What happened
The Klever Go package, versions prior to 1.7.19, reportedly contains an integer overflow vulnerability in the split-royalty validation. This issue arises from the absence of an upper bound on per-entry percentages, which may lead to potential exploitation. The vulnerability, tracked as GHSA-CGC5-V3F2-8M2V and CVE-2026-54755, was first flagged on August 28, 2026.
The vulnerability may allow for unbounded minting of KLV tokens, as the lack of an upper bound on percentages could result in invalid calculations. Additionally, another related issue, tracked as GHSA-p7gw-2pcp-5pf8 and CVE-2026-54754, indicates that the marketplace settlement may mint KLV tokens when the sum of referral and royalty percentages exceeds the bid, silently skipping the negative seller share.
What to do about it
- Monitor the Klever Go repository for patches and updates.
- Consider implementing additional validation checks in your code to mitigate potential risks.
- Review your use of the Klever Go package and assess whether you are using an affected version.
- If you are using a version of klever-go prior to 1.7.19, plan to upgrade as soon as a patch is available.
- No official fix has been published yet. Monitor the sources below for updates.
How 0Day would have caught this
klever-go is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You may be affected if you are using the klever-go package in versions prior to 1.7.19.
What should I do right now?
Monitor for patches and updates from the Klever Go repository. Consider implementing additional validation checks in your code to mitigate potential risks.
Is there an official patch available?
No official patch has been published yet. Continue to monitor the sources for updates.