stellar vulnerabilities

Products

• rs-soroban-sdk 3
• freighter 1
• js-stellar-sdk 1
• rs-soroban-poseidon 1
• rs-stellar-strkey 1
• rs-stellar-xdr 1
• stellar-core 1
• stellar-xdr 1

Latest stellar CVEs

Newest publication first

1. CVE-2026-32322 soroban-sdk: `Fr` scalar field equality comparison bypasses modular reduction

   Published 2026-03-12

   Medium·CVSS 5.3 EPSS 0.31%

   soroban-sdk is a Rust SDK for Soroban contracts. Prior to 22.0.11, 23.5.3, and 25.3.0, The Fr (scalar field) types for BN254 and BLS12-381 in soroban-sdk compared values using their raw U256 representation without first reducing modulo the field modulus r. This caused mathematica...

2. CVE-2026-32129 Poseidon V1 variable-length input collision via implicit zero-padding

   Published 2026-03-12

   High·CVSS 8.7 EPSS 0.23%

   soroban-poseidon provides Poseidon and Poseidon2 cryptographic hash functions for Soroban smart contracts. Poseidon V1 (PoseidonSponge) accepts variable-length inputs without injective padding. When a caller provides fewer inputs than the sponge rate (inputs.len() < T - 1), unuse...

3. CVE-2026-29795 stellar-xdr: `StringM::from_str` bypasses max length validation

   Published 2026-03-06

   High·CVSS 7.5 EPSS 0.22%

   stellar-xdr is a library and CLI containing types and functionality for working with Stellar XDR. Prior to version 25.0.1, StringM::from_str does not validate that the input length is within the declared maximum (MAX). Calling StringM::<N>::from_str(s) where s is longer than N by...

4. CVE-2026-26267 rs-soroban-sdk #[contractimpl] macro calls inherent function instead of trait function when names collide

   Published 2026-02-19

   High·CVSS 7.5 EPSS 0.36%

   soroban-sdk is a Rust SDK for Soroban contracts. Prior to versions 22.0.10, 23.5.2, and 25.1.1, the #[contractimpl] macro contains a bug in how it wires up function calls. #[contractimpl] generates code that uses MyContract::value() style calls even when it's processing the trait...

5. CVE-2026-24889 soroban-sdk has overflow in Bytes::slice, Vec::slice, GenRange::gen_range for u64

   Published 2026-01-28

   Medium·CVSS 5.3 EPSS 0.38%

   soroban-sdk is a Rust SDK for Soroban contracts. Arithmetic overflow can be triggered in the Bytes::slice, Vec::slice, and Prng::gen_range (for u64) methods in the soroban-sdk in versions up to and including 25.0.1, 23.5.1, and 25.0.2. Contracts that pass user-controlled or compu...

6. CVE-2024-32985 Stellar-core's Overlay - security fix for DDoS mitigation

   Published 2024-05-09

   Medium·CVSS 5.9 EPSS 0.45%

   Stellar-core is a reference implementation for the peer-to-peer agent that manages the Stellar network. Prior to 20.4.0, core nodes could be randomly crashed due to a race condition with a 3rd party library. The likelihood of affecting the network is low since crashed nodes come...

7. CVE-2023-46135 Panic in SignedPayload::from_payload

   Published 2023-10-25

   High·CVSS 7.5 EPSS 0.95%

   rs-stellar-strkey is a Rust lib for encode/decode of Stellar Strkeys. A panic vulnerability occurs when a specially crafted payload is used.inner_payload_len should not above 64. This vulnerability has been patched in version 0.0.8.

8. CVE-2023-40580 Freighter mnemonic phrase may be accessed by Javascript through a private API

   Published 2023-08-25

   Medium·CVSS 6.5 EPSS 0.82%

   Freighter is a Stellar chrome extension. It may be possible for a malicious website to access the recovery mnemonic phrase when the Freighter wallet is unlocked. This vulnerability impacts access control to the mnemonic recovery phrase. This issue was patched in version 5.3.1.

9. CVE-2021-32738 Utils.readChallengeTx does not verify the server account signature

   Published 2021-07-02

   Medium·CVSS 6.5 EPSS 0.51%

   js-stellar-sdk is a Javascript library for communicating with a Stellar Horizon server. The Utils.readChallengeTx function used in SEP-10 Stellar Web Authentication states in its function documentation that it reads and validates the challenge transaction including verifying that...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.