CVE-2026-61694
Published:October 30, 2026
Updated:November 04, 2026
go-xrpl is a Go implementation of the XRP Ledger protocol. In versions through the June 18, 2026 revision identified by the advisory, "ParseMPTAmountBinary" in "internal/ledger/state/ripple_state.go" converts the eight-byte MPT magnitude using "num.Int64()" without checking that it fits in 63 bits. A positive magnitude of at least 2^63 silently wraps into a negative amount without an error. "ParseEscrow" passes 33-byte "sfAmount" fields to the parser and stores "MPTRaw()" in "EscrowData.MPTAmount", causing incorrect downstream calculations and divergence from rippled's interpretation of the same escrow entry. Independently, "readMPTAmount" in "internal/tx/ledgerfields/decode_stream.go" accepts over-limit magnitudes and surfaces large decimal strings without enforcing the maximum signed 64-bit value. The public codec in codec/binarycodec/types/amount.go already rejects these values, leaving the internal decoders inconsistent with that safe path. A source fix is available in commit 9dbd3935ed6c54f0232f2291edf9c012a0900dd5.
Affected Packages
github.com/LeJamon/go-xrpl (GO):
Affected version(s) >=v0.0.0-20260417104617-e0ce97420257 <v0.0.0-20260624143208-9dbd3935ed6cFix Suggestion:
Update to version v0.0.0-20260624143208-9dbd3935ed6cRelated Resources (5)
Do you need more information?
Contact UsCVSS v4
Base Score:
6.3
Attack Vector
NETWORK
Attack Complexity
HIGH
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
NONE
Vulnerable System Integrity
LOW
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
3.7
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
LOW
Availability
NONE
Weakness Type (CWE)
Integer Overflow or Wraparound
EPSS
Base Score:
0.27