CVE-2026-55763

CVE-2026-55763 affects Klever-Go (the Go implementation of the Klever blockchain), prior to version 1.7.19 . In processPercentageRoyaltiesTransfer (core/kapp/accounts/accounts.go), the sender's royalty debit via SubFromBalance is ordered after the split loop and after the royaltiesToPay

CVE-2026-55763 Klever-Go: Percentage-transfer royalty skips the source debit at exactly-100% splits

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, processPercentageRoyaltiesTransfer in core/kapp/accounts/accounts.go calls SubFromBalance after the split loop and after the royaltiesToPay royaltiesToPay, so a valid PercentTransferPercentage = 10000 split...

EUVD-2026-67942

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, processPercentageRoyaltiesTransfer in core/kapp/accounts/accounts.go calls SubFromBalance after the split loop and after the royaltiesToPay royaltiesToPay, so a valid PercentTransferPercentage = 10000 split...

CVE-2026-54755

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, split-royalty fields decoded in core/kapp/builtInFunctions/utils.go can contain values greater than core.HundredPercent, and core/kapp/kda/create.go and core/kapp/kda/trigger.go sum those values in uint32...

Klever: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token)

Summary The per-entry percentages of a KDA asset's split royalties are validated by summing them into a uint32 accumulator and checking the sum against HundredPercent 10000, with no upper bound on each individual entry. Two split entries whose percentages sum to just over 2^32 wrap around below...

GHSA-CGC5-V3F2-8M2V Klever: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token)

Summary The per-entry percentages of a KDA asset's split royalties are validated by summing them into a uint32 accumulator and checking the sum against HundredPercent 10000, with no upper bound on each individual entry. Two split entries whose percentages sum to just over 2^32 wrap around below...

EUVD-2026-67825

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, split-royalty fields decoded in core/kapp/builtInFunctions/utils.go can contain values greater than core.HundredPercent, and core/kapp/kda/create.go and core/kapp/kda/trigger.go sum those values in uint32...

CVE-2026-54755

Klever-Go (the Go implementation of the Klever blockchain) contains a uint32 integer overflow in split-royalty validation. Per-entry royalty percentages are decoded without an upper bound, and the validation sum wraps to zero when two crafted values (e.g., 0x80000000 each) overflow uint32, passin...

CVE-2026-54755

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, split-royalty fields decoded in core/kapp/builtInFunctions/utils.go can contain values greater than core.HundredPercent, and core/kapp/kda/create.go and core/kapp/kda/trigger.go sum those values in uint32...

CVE-2026-54755 Klever-Go: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token)

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, split-royalty fields decoded in core/kapp/builtInFunctions/utils.go can contain values greater than core.HundredPercent, and core/kapp/kda/create.go and core/kapp/kda/trigger.go sum those values in uint32...

CVE-2026-54755 Klever-Go: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token)

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, split-royalty fields decoded in core/kapp/builtInFunctions/utils.go can contain values greater than core.HundredPercent, and core/kapp/kda/create.go and core/kapp/kda/trigger.go sum those values in uint32...

CVE-2026-54755 Klever-Go: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token)

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, split-royalty fields decoded in core/kapp/builtInFunctions/utils.go can contain values greater than core.HundredPercent, and core/kapp/kda/create.go and core/kapp/kda/trigger.go sum those values in uint32...

CVE-2026-54755: Integer Overflow or Wraparound

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, split-royalty fields decoded in core/kapp/builtInFunctions/utils.go can contain values greater than core.HundredPercent, and core/kapp/kda/create.go and core/kapp/kda/trigger.go sum those values in uint32...

PT-2026-83020

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A deadlock can occur in the iomap component when the iomap split ioend function splits bios that already originate from the iomap ioend bioset. This happens when the bioset is exhausted,...

PT-2026-83228

Name of the Vulnerable Software and Affected Versions Klever-Go versions prior to 1.7.19 Description An integer overflow exists in the handling of split-royalty fields. The software validates split royalties by summing them into a uint32 accumulator and checking if the total is within...

MAC Forgery Vulnerability

Bouncy Castle for Java is vulnerable to a MAC forgery vulnerability. The vulnerability is due to improper handling of the KDF key split based on message length, which allows an attacker to forge the MAC and potentially modify or authenticate manipulated ciphertext without detection...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ntfs3: Validation of the split-point offset in indxinsertintobuffer The indxinsertintobuffer function calculates: c used = used1 - tocopy - spsize; memmovedet, Add2Ptrsp, spsize, used - le32tocpuhdr1-deoff; Where sp and spsize co...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: gve: Fixed header buffer corruption with header-split and HW-GRO. The DQO RX datapath programs the headerbufaddr for each buffer-queue-descriptor at the post-time, and reads the split header back at the completion time. Both t...

UBUNTU-CVE-2026-74591

In the Linux kernel, the following vulnerability has been resolved: mm/filemap: filemapaddfolio restore index before retrying In filemapaddfolio's split-a-conflict loop, xassetorder is applied repeatedly: each application modifies xas.xaindex, rounding it down according to the splitorder attempte...

Duplicate Advisory: GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-wvpp-8hx9-p66j. This link is maintained to preserve external references. Original Description GitPython before 3.1.58 contains a command execution vulnerability in the checkunsafeoptions guard that can be bypass...