Poseidon V1 variable-length input collision via implicit zero-padding
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
soroban-poseidon provides Poseidon and Poseidon2 cryptographic hash functions for Soroban smart contracts. Poseidon V1 (PoseidonSponge) accepts variable-length inputs without injective padding. When a caller provides fewer inputs than the sponge rate (inputs.len() < T - 1), unused rate positions are implicitly zero-filled. This allows trivial hash collisions: for any input vector [m1, ..., mk] hashed with a sponge of rate > k, hash([m1, ..., mk]) equals hash([m1, ..., mk, 0]) because both produce identical pre-permutation states. This affects any use of PoseidonSponge or poseidon_hash where the number of inputs is less than T - 1 (e.g., hashing 1 input with T=3). Poseidon2 (Poseidon2Sponge) is not affected.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| stellar | rs-soroban-poseidon | before 25.0.1 | 25.0.1 | Patch available | CNA |
| — | soroban-poseidon (crates.io) | before 25.0.1 | 25.0.1 | Patch available | GHSA-g2p6-hh5v-7hfm |
- rs-soroban-poseidon Vendorstellar Affected before 25.0.1 Fixed in 25.0.1 Patch available CNA
- soroban-poseidon (crates.io) Vendor— Affected before 25.0.1 Fixed in 25.0.1 Patch available GHSA-g2p6-hh5v-7hfm
Remediation
- Fix · CNA rs-soroban-poseidon (stellar) Fixed in 25.0.1
- Fix · GHSA-g2p6-hh5v-7hfm soroban-poseidon (crates.io) Fixed in 25.0.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-32129
- 2026-10-03 Alias added: GHSA-g2p6-hh5v-7hfm
References
Other 5
- https://github.com/stellar/rs-soroban-poseidon/security/advisories/GHSA-g2p6-hh5v-7hfm
- https://github.com/stellar/rs-soroban-poseidon/pull/10
- https://github.com/stellar/rs-soroban-poseidon/releases/tag/v25.0.1
- https://github.com/stellar/rs-soroban-poseidon/commit/ceb20d3593fc4a8a951a7e99d8fa2344f8250a8c
- https://github.com/stellar/rs-soroban-poseidon
More stellar vulnerabilities
- TI-2023-24777 Panic in SignedPayload::from_payload CVSS 3.1HIGH 7.5
- TI-2026-21237 rs-soroban-sdk #[contractimpl] macro calls inherent function instead of trait function when names collide CVSS 3.1HIGH 7.5
- TI-2023-21378 Freighter mnemonic phrase may be accessed by Javascript through a private API CVSS 3.1HIGH 8.1
- TI-2026-23381 stellar-xdr: `StringM::from_str` bypasses max length validation CVSS 3.1HIGH 7.5
- TI-2026-24850 soroban-sdk: `Fr` scalar field equality comparison bypasses modular reduction CVSS 3.1MEDIUM 5.3
- TI-2026-20074 soroban-sdk has overflow in Bytes::slice, Vec::slice, GenRange::gen_range for u64 CVSS 3.1MEDIUM 5.3
Sources
- CVE-2026-32129 · CVE Program
- CVE-2026-32129 · NVD
- FIRST EPSS
- GHSA-g2p6-hh5v-7hfm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences