{"id":"CVE-2026-61694","kind":"vulnerability","aliases":["CVE-2026-61694"],"related":[],"title":"go-xrpl: MPT amount parsing wraps large values negative, diverging from rippled","description":"go-xrpl is a Go implementation of the XRP Ledger protocol. In versions through the June 18, 2026 revision identified by the advisory, `ParseMPTAmountBinary` in `internal/ledger/state/ripple_state.go` converts the eight-byte MPT magnitude using `num.Int64()` without checking that it fits in 63 bits. A positive magnitude of at least 2^63 silently wraps into a negative amount without an error. `ParseEscrow` passes 33-byte `sfAmount` fields to the parser and stores `MPTRaw()` in `EscrowData.MPTAmount`, causing incorrect downstream calculations and divergence from rippled's interpretation of the same escrow entry. Independently, `readMPTAmount` in `internal/tx/ledgerfields/decode_stream.go` accepts over-limit magnitudes and surfaces large decimal strings without enforcing the maximum signed 64-bit value. The public codec in codec/binarycodec/types/amount.go already rejects these values, leaving the internal decoders inconsistent with that safe path. A source fix is available in commit 9dbd3935ed6c54f0232f2291edf9c012a0900dd5.","summary":"go-xrpl is a Go implementation of the XRP Ledger protocol, and its internal MPT amount decoders accept magnitudes of 2^63 or more without checking them. Such values silently wrap into negative amounts, so escrow calculations can differ from rippled's interpretation of the same ledger entry.","severity":"low","cvss":3.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["go-xrpl","golang","package","xrp-ledger"],"not_affected_if":["no-escrow-parsing","public-codec-only"],"how_to_check":"- Check whether the project depends on go-xrpl with `go list -m all | grep go-xrpl`\n- Look for calls to `ParseMPTAmountBinary`, `ParseEscrow` or `readMPTAmount` in your code\n- Compare the go-xrpl version in `go.mod` against the affected revision in the advisory","fix":"- A source fix exists in commit 9dbd3935ed6c54f0232f2291edf9c012a0900dd5; the sources do not give a released version number, so unknown","status":"open","published_at":"2026-10-30T20:17:11+00:00","first_seen_at":"2026-10-30T20:25:38+00:00","triaged_at":"2026-10-30T20:26:56+00:00","updated_at":"2026-10-30T20:26:56+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T20:26:56Z","model":"claude-haiku-5-5","output":{"fix":"- A source fix exists in commit 9dbd3935ed6c54f0232f2291edf9c012a0900dd5; the sources do not give a released version number, so unknown","reach":"unknown","title":"go-xrpl: MPT amount parsing wraps large values negative, diverging from rippled","impact":"low","summary":"go-xrpl is a Go implementation of the XRP Ledger protocol, and its internal MPT amount decoders accept magnitudes of 2^63 or more without checking them. Such values silently wrap into negative amounts, so escrow calculations can differ from rippled's interpretation of the same ledger entry.","audience":"developers","category":"package","nicknames":[],"who_cares":["go-xrpl","golang","xrp-ledger"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Escrow amounts are misread as negative, causing wrong downstream calculations","analyst_note":"","how_to_check":"- Check whether the project depends on go-xrpl with `go list -m all | grep go-xrpl`\n- Look for calls to `ParseMPTAmountBinary`, `ParseEscrow` or `readMPTAmount` in your code\n- Compare the go-xrpl version in `go.mod` against the affected revision in the advisory","plain_action":"","needs_analyst":false,"not_affected_if":["public-codec-only","no-escrow-parsing"],"who_is_affected":"Only systems that embed go-xrpl and parse MPT amounts or escrow entries from ledger data are exposed. The public codec path already rejects these values, so code that uses only that path is not affected. Teams running XRP Ledger tooling that makes financial decisions from escrow amounts are the ones to look at first.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000761,"input_tokens":4416,"output_tokens":639,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-61694':16A,19A '18':94C '2':49B,127C '2026':95C '33':140C '63':50B,119C,128C '64':186C '9dbd3935ed6c54f0232f2291edf9c012a0900dd5':214C 'accept':46B,171C 'advisori':100C 'alreadi':194C 'amount':5A,44B,62B,134C 'avail':211C 'bit':120C,187C 'byte':108C,141C 'calcul':65B,155C 'caus':152C 'check':54B,114C 'codec':191C 'codec/binarycodec/types/amount.go':193C 'commit':213C 'convert':104C 'cve':14A,17A 'decim':179C 'decod':45B,201C 'differ':67B 'diverg':11A,157C 'downstream':154C 'eight':107C 'eight-byt':106C 'enforc':182C 'entri':76B,166C 'error':137C 'escrow':64B,165C 'escrowdata.mptamount':151C 'field':143C 'fit':117C 'fix':209C 'go':2A,21B,29B,33B,78C,82C 'go-xrpl':1A,20B,28B,77C 'golang':23B 'identifi':97C 'implement':34B,83C 'inconsist':202C 'incorrect':153C 'independ':167C 'intern':42B,200C 'internal/ledger/state/ripple_state.go':103C 'internal/tx/ledgerfields/decode_stream.go':170C 'interpret':71B,161C 'june':93C 'larg':8A,178C 'least':126C 'leav':198C 'ledger':27B,38B,75B,87C 'limit':174C 'magnitud':47B,110C,123C,175C 'maximum':184C 'mpt':4A,43B,109C 'mptraw':149C 'negat':10A,61B,133C 'num.int64':112C 'over-limit':172C 'packag':24B 'pars':6A 'parseescrow':138C 'parsemptamountbinari':101C 'parser':146C 'pass':139C 'path':206C 'posit':122C 'protocol':39B,88C 'public':190C 'readmptamount':168C 'reject':195C 'revis':96C 'rippl':13A,69B,159C 'safe':205C 'sfamount':142C 'sign':185C 'silent':58B,129C 'sourc':208C 'store':148C 'string':180C 'surfac':177C 'use':111C 'valu':9A,57B,188C,197C 'version':90C 'without':53B,113C,135C,181C 'wrap':7A,59B,130C 'xrp':26B,37B,86C 'xrp-ledger':25B 'xrpl':3A,22B,30B,79C","nicknames":[],"mitigations":[],"who_affected":"Only systems that embed go-xrpl and parse MPT amounts or escrow entries from ledger data are exposed. The public codec path already rejects these values, so code that uses only that path is not affected. Teams running XRP Ledger tooling that makes financial decisions from escrow amounts are the ones to look at first.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T20:17:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-61694","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61694","severity":null,"published_at":"2026-10-30T20:17:11+00:00","modified_at":"2026-10-30T20:17:11+00:00","first_seen_at":"2026-10-30T20:25:38+00:00","fetched_at":"2026-10-30T20:25:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}