Threats affecting pkg:golang/github.com/lejamon/go-xrpl

CVE-2026-61694 is an integer overflow vulnerability in the LeJamon go-xrpl library, a Go implementation of the XRP Ledger protocol. The flaw occurs in the function ParseMPTAmountBinary, which converts an eight-byte magnitude to int64 without checking for overflow, causing large positive values to wrap into negative numbers silently. This leads to incorrect escrow amount calculations and divergence from the reference rippled implementation. Another related internal decoder accepts over-limit magnitudes without enforcing 64-bit signed integer limits, creating inconsistencies. A source code fix is available in a specific commit.