{"items":[{"id":"NVI-00013946","kind":"vulnerability","title":"klever-go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-mrpp-v6pg-p54x","CVE-2026-55764"],"plain_summary":"GitHub lists this reviewed advisory for github.com/klever-io/klever-go. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-178f0c79b979f5e9034a5ab89595c4b4"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"EPSS","as_of":"2026-11-04T12:03:12.000Z","value":"0.538%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.45409. Missing scores are unknown.","source_id":"sr-178f0c79b979f5e9034a5ab89595c4b4"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-2353225b89965ef5524d89a39c8f3329","url":"https://github.com/advisories/GHSA-mrpp-v6pg-p54x","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-mrpp-v6pg-p54x","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T02:21:58.521Z"},{"id":"sr-178f0c79b979f5e9034a5ab89595c4b4","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-55764","publisher":"FIRST EPSS","observed_at":"2026-11-04T23:33:33.050Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-2353225b89965ef5524d89a39c8f3329"],"technology":"github.com/klever-io/klever-go","known_exclusions":[],"conditions_summary":"## Summary\nOn the SFT add-quantity path the only supply bound is `SFTAddCirculation`, which does\n`meta.Circulation += amount` with **no overflow guard**, then checks\n`if meta.Circulation > meta.MaxSupply && meta.MaxSupply != 0`. If `amount` overflows `int64` and wraps\n**negative**, `negative > MaxSupply` is false, the cap check passes, the function returns `nil`, and the balance\ncredit stands. A nonce created with a finite `MaxSupply` (e.g. 1000) can thus be minted to ~`MaxInt64` tokens in\none transaction. The fungible mint path is **not** vulnerable — it has a post-increment `MintedValue <= 0` guard\nthat the SFT path lacks.\n\n## Affected code\n- `core/kapp/systemAccount/systemAcount.go:132-138` (`SFTAddCirculation`, the unguarded `+=`).\n- Caller: `core/kapp/kda/mint.go:247-283` (`processSemiFungibleAddQuantity`); contrast guard `mint.go:289`.\n\n## Impact\nA mint-role holder mints ~9.2e18 units of a nonce whose declared `MaxSupply` is small, with no authorized debit,\nand corrupts the on-chain `Circulation` counter to a negative value (misleading any market/indexer that reads it).\n\n## Reachability\nMint-role holder (asset owner or an address granted the role). The mint `Amount` is a raw ","public_affected_ranges":["< 1.7.19"]}],"null_published_at":"2026-11-08T19:53:38.939Z","source_updated_at":"2026-08-28T22:08:56.000Z","source_disclosed_at":"2026-08-28T22:08:56.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-11-02T02:21:58.521Z"},{"id":"NVI-00013946","kind":"vulnerability","title":"klever-go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-mrpp-v6pg-p54x","CVE-2026-55764"],"plain_summary":"GitHub lists this reviewed advisory for github.com/klever-io/klever-go. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-2353225b89965ef5524d89a39c8f3329"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-2353225b89965ef5524d89a39c8f3329","url":"https://github.com/advisories/GHSA-mrpp-v6pg-p54x","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-mrpp-v6pg-p54x","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T02:21:58.521Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-2353225b89965ef5524d89a39c8f3329"],"technology":"github.com/klever-io/klever-go","known_exclusions":[],"conditions_summary":"## Summary\nOn the SFT add-quantity path the only supply bound is `SFTAddCirculation`, which does\n`meta.Circulation += amount` with **no overflow guard**, then checks\n`if meta.Circulation > meta.MaxSupply && meta.MaxSupply != 0`. If `amount` overflows `int64` and wraps\n**negative**, `negative > MaxSupply` is false, the cap check passes, the function returns `nil`, and the balance\ncredit stands. A nonce created with a finite `MaxSupply` (e.g. 1000) can thus be minted to ~`MaxInt64` tokens in\none transaction. The fungible mint path is **not** vulnerable — it has a post-increment `MintedValue <= 0` guard\nthat the SFT path lacks.\n\n## Affected code\n- `core/kapp/systemAccount/systemAcount.go:132-138` (`SFTAddCirculation`, the unguarded `+=`).\n- Caller: `core/kapp/kda/mint.go:247-283` (`processSemiFungibleAddQuantity`); contrast guard `mint.go:289`.\n\n## Impact\nA mint-role holder mints ~9.2e18 units of a nonce whose declared `MaxSupply` is small, with no authorized debit,\nand corrupts the on-chain `Circulation` counter to a negative value (misleading any market/indexer that reads it).\n\n## Reachability\nMint-role holder (asset owner or an address granted the role). The mint `Amount` is a raw ","public_affected_ranges":["< 1.7.19"]}],"null_published_at":"2026-11-02T10:00:37.177Z","source_updated_at":"2026-08-28T22:08:56.000Z","source_disclosed_at":"2026-08-28T22:08:56.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-02T02:21:58.521Z"}],"next_cursor":null,"snapshot_revision":"42594"}