HIGH GitHub
CVE-2026-55763
klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits
## Summary
In `processPercentageRoyaltiesTransfer` the royalty pool is collected from the sender by `SubFromBalance` that is
ordered **after** the split loop and after `if royaltiesToPay <= 0 { return Ok }`. The split-payout guard rejects
only an allocation that *exceeds* the pool (a strict `splitToPay > royaltiesToPay`), so a split entry of **exactly
100%** (`PercentTransferPercentage = 10000`) is a *valid* config: it drives `royaltiesToPay` to 0 and hits the
early-return **before** the sender
Affected Products
- go/github.com/klever-io/klever-go <= 1.7.19-rc2
References
- https://github.com/advisories/GHSA-v358-wf77-39xv
- https://github.com/klever-io/klever-go/security/advisories/GHSA-v358-wf77-39xv
- https://github.com/klever-io/klever-go/commit/8bcc600b0ac88070740c63c7ce1c8a968dd85251
- https://github.com/klever-io/klever-go/releases/tag/v1.7.19
This high severity vulnerability was published on 2026-08-28 via GitHub. Affected: go/github.com/klever-io/klever-go <= 1.7.19-rc2.
vulnfeed aggregates 11493 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.