Live › vulnerability › CVE-2026-61694
go-xrpl is a Go implementation of the XRP Ledger protocol, and its internal MPT amount decoders accept magnitudes of 2^63 or more without checking them. Such values silently wrap into negative amounts, so escrow calculations can differ from rippled's interpretation of the same ledger entry.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 20:25 UTC. All times on this page are UTC.
Only systems that embed go-xrpl and parse MPT amounts or escrow entries from ledger data are exposed. The public codec path already rejects these values, so code that uses only that path is not affected. Teams running XRP Ledger tooling that makes financial decisions from escrow amounts are the ones to look at first.
No product ranges from the sources yet.
go list -m all | grep go-xrplParseMPTAmountBinary, ParseEscrow or readMPTAmount in your codego.mod against the affected revision in the advisoryEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
go-xrpl is a Go implementation of the XRP Ledger protocol. In versions through the June 18, 2026 revision identified by the advisory, ParseMPTAmountBinary in internal/ledger/state/ripple_state.go converts the eight-byte MPT magnitude using num.Int64() without checking that it fits in 63 bits. A positive magnitude of at least 2^63 silently wraps into a negative amount without an error. ParseEscrow passes 33-byte sfAmount fields to the parser and stores MPTRaw() in EscrowData.MPTAmount, causing incorrect downstream calculations and divergence from rippled's interpretation of the same escrow entry. Independently, readMPTAmount in internal/tx/ledgerfields/decode_stream.go accepts over-limit magnitudes and surfaces large decimal strings without enforcing the maximum signed 64-bit value. The public codec in codec/binarycodec/types/amount.go already rejects these values, leaving the internal decoders inconsistent with that safe path. A source fix is available in commit 9dbd3935ed6c54f0232f2291edf9c012a0900dd5.
This page as .md · .json · in your agent: get_signal("CVE-2026-61694")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.