stellar-xdr: `StringM::from_str` bypasses max length validation
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-770.
Summary
stellar-xdr is a library and CLI containing types and functionality for working with Stellar XDR. Prior to version 25.0.1, StringM::from_str does not validate that the input length is within the declared maximum (MAX). Calling StringM::<N>::from_str(s) where s is longer than N bytes succeeds and returns an Ok value instead of Err(Error::LengthExceedsMax), producing a StringM that violates its length invariant. This affects any code that constructs StringM values from string input using FromStr (including str::parse), and relies on the type's maximum length constraint being enforced. An oversized StringM could propagate through serialization, validation, or other logic that assumes the invariant holds. This issue has been patched in version 25.0.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| stellar | rs-stellar-xdr | before 25.0.1 | 25.0.1 | Patch available | CNA |
| — | stellar-xdr (crates.io) | before 25.0.1 | 25.0.1 | Patch available | GHSA-x57h-xx53-v53w |
- rs-stellar-xdr Vendorstellar Affected before 25.0.1 Fixed in 25.0.1 Patch available CNA
- stellar-xdr (crates.io) Vendor— Affected before 25.0.1 Fixed in 25.0.1 Patch available GHSA-x57h-xx53-v53w
Remediation
- Fix · CNA rs-stellar-xdr (stellar) Fixed in 25.0.1
- Fix · GHSA-x57h-xx53-v53w stellar-xdr (crates.io) Fixed in 25.0.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-29795
- 2026-10-03 Alias added: GHSA-x57h-xx53-v53w
References
Patch 3
Sources
- CVE-2026-29795 · CVE Program
- CVE-2026-29795 · NVD
- FIRST EPSS
- GHSA-x57h-xx53-v53w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences