SZB-3342a9b8d6
EUVD-2026-114378 reports flaw in go-xrpl MPT amount parsing (CVSS 3.7)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- LeJamon
- Product
- go-xrpl
- First seen
Summary
The EUVD entry, relayed on Mastodon, says that through the June 18, 2026 revision, go-xrpl's ParseMPTAmountBinary converts an eight-byte MPT magnitude in a way that is flawed. It gives a CVSS v3.1 score of 3.7/10 and was last updated 2026-10-30.
If you use LeJamon
Check the go-xrpl advisory for a fixed release and upgrade to it
Review whether your application parses MPT amounts from untrusted ledger data
What the sources say 1
· Mastodon: “In versions through the June 18, 2026 revision identified by the advisory, `ParseMPTAmountBinary` in `internal/ledger/state/ripple_state.go` converts the eight-byte MPT magnitude using `num.Int64()...” Source