stellar

Records9All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high5CVSS 7.0–8.9

Exploited now

stellar records in CISA KEV

No stellar vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Rs-soroban-sdk 3 records LOW Freighter 1 record LOW Js-stellar-sdk 1 record LOW Rs-stellar-strkey 1 record HIGH Stellar-xdr 1 record LOW

Records

9 records

TI-2023-24777 CVE-2023-46135 · GHSA-5873-6fwq-463f

Panic in SignedPayload::from_payload

HIGH 72

rs-stellar-strkey is a Rust lib for encode/decode of Stellar Strkeys.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00951 Published 2023-10-25 Fixed in 0.0.8 CWE-248

TI-2026-24666 CVE-2026-32129 · GHSA-g2p6-hh5v-7hfm

Poseidon V1 variable-length input collision via implicit zero-padding

MEDIUM 43

soroban-poseidon provides Poseidon and Poseidon2 cryptographic hash functions for Soroban smart contracts.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00234 Published 2026-03-12 Fixed in 25.0.1 CWE-328

TI-2026-21237 CVE-2026-26267 · GHSA-4chv-4c6w-w254

rs-soroban-sdk #[contractimpl] macro calls inherent function instead of trait function when names collide

LOW 39

soroban-sdk is a Rust SDK for Soroban contracts.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00361 Published 2026-02-19 Fixed in 25.1.1, 23.5.2 +1 CWE-670

TI-2023-21378 CVE-2023-40580

Freighter mnemonic phrase may be accessed by Javascript through a private API

LOW 37

Freighter is a Stellar chrome extension.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00819 Published 2023-08-25 Fixed in 5.3.1 CWE-200

TI-2026-23381 CVE-2026-29795 · GHSA-x57h-xx53-v53w

stellar-xdr: `StringM::from_str` bypasses max length validation

LOW 32

stellar-xdr is a library and CLI containing types and functionality for working with Stellar XDR.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00224 Published 2026-03-06 Fixed in 25.0.1 CWE-770

TI-2026-24850 CVE-2026-32322 · GHSA-x2hw-px52-wp4m

soroban-sdk: `Fr` scalar field equality comparison bypasses modular reduction

LOW 30

soroban-sdk is a Rust SDK for Soroban contracts.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00307 Published 2026-03-12 Fixed in 25.3.0, 23.5.3 +1 CWE-697

TI-2026-20074 CVE-2026-24889 · GHSA-96xm-fv9w-pf3f

soroban-sdk has overflow in Bytes::slice, Vec::slice, GenRange::gen_range for u64

LOW 30

soroban-sdk is a Rust SDK for Soroban contracts.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00384 Published 2026-01-28 Fixed in 22.0.9, 23.5.1 +1 CWE-190

TI-2021-12406 CVE-2021-32738 · GHSA-6cgh-hjpw-q3gq

Utils.readChallengeTx does not verify the server account signature

LOW 29

js-stellar-sdk is a Javascript library for communicating with a Stellar Horizon server.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00514 Published 2021-07-02 Fixed in 8.2.3 CWE-287

TI-2024-21851 CVE-2024-32985

Stellar-core's Overlay - security fix for DDoS mitigation

LOW 27

Stellar-core is a reference implementation for the peer-to-peer agent that manages the Stellar network.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00449 Published 2024-05-09 Fixed in 20.4.0 CWE-362

Open these records in search →

Critical	0
High	5
Medium	4
Low	0
No CVSS	0