Answer in brief
CVE-2026-55763 records a High severity (CVSS 0.0) vulnerability in Klever-Go: Percentage-transfer royalty skips the source debit at exactly-100% splits. The current sources do not mark it as known exploited. The current feed maps klever-io/klever-go (generic), github.com/klever-io/klever-go (go), github.com/klever-io/klever-go (go). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 0.0. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps klever-io/klever-go (generic), github.com/klever-io/klever-go (go), github.com/klever-io/klever-go (go). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| klever-io/klever-gogeneric | < 1.7.19 | Not reported |
| github.com/klever-io/klever-gogo | <=1.7.19-rc2 | 1.7.19-rc4 |
| github.com/klever-io/klever-gogo | >=0 <1.7.19-rc4 | 1.7.19-rc4 |
Published upstream
Aug 28, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 9, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 28, 2026
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, processPercentageRoyaltiesTransfer in core/kapp/accounts/accounts.go calls SubFromBalance after the split loop and after the royaltiesToPay <= 0 early return. computeSplitRoyalties rejects only when splitToPay > royaltiesToPay, so a valid PercentTransferPercentage = 10000 split consumes exactly 100 percent of the royalty pool, sets royaltiesToPay to zero, and returns before the source account is debited. The split recipient receives the full royaltyAmount while the sender pays nothing and the supply counter is not updated, allowing unbounded off-the-books inflation of the transferred KDA. A KDA owner must configure a TransferPercentage royalty with a 100 percent split, after which any holder's transfer of the asset triggers the mint; the sibling processFixedRoyaltiesTransfer path is not affected because it debits the source before distribution. This issue is fixed in version 1.7.19.
Quoted source text, attributed separately from HOL analysis.