TI-2026-24850 CVE-2026-32322 · GHSA-x2hw-px52-wp4m
soroban-sdk: `Fr` scalar field equality comparison bypasses modular reduction
Priority LOW 30
soroban-sdk is a Rust SDK for Soroban contracts.
Vulnerabilities
9 records
TI-2026-24666 CVE-2026-32129 · GHSA-g2p6-hh5v-7hfm
Poseidon V1 variable-length input collision via implicit zero-padding
Priority MEDIUM 43
soroban-poseidon provides Poseidon and Poseidon2 cryptographic hash functions for Soroban smart contracts.
TI-2026-23381 CVE-2026-29795 · GHSA-x57h-xx53-v53w
stellar-xdr: `StringM::from_str` bypasses max length validation
Priority LOW 32
stellar-xdr is a library and CLI containing types and functionality for working with Stellar XDR.
TI-2026-21237 CVE-2026-26267 · GHSA-4chv-4c6w-w254
rs-soroban-sdk #[contractimpl] macro calls inherent function instead of trait function when names collide
Priority LOW 39
soroban-sdk is a Rust SDK for Soroban contracts.
TI-2026-20074 CVE-2026-24889 · GHSA-96xm-fv9w-pf3f
soroban-sdk has overflow in Bytes::slice, Vec::slice, GenRange::gen_range for u64
Priority LOW 30
soroban-sdk is a Rust SDK for Soroban contracts.
Priority LOW 27
Stellar-core is a reference implementation for the peer-to-peer agent that manages the Stellar network.
TI-2023-24777 CVE-2023-46135 · GHSA-5873-6fwq-463f
Panic in SignedPayload::from_payload
Priority HIGH 72
rs-stellar-strkey is a Rust lib for encode/decode of Stellar Strkeys.
TI-2023-21378 CVE-2023-40580
Freighter mnemonic phrase may be accessed by Javascript through a private API
Priority LOW 37
Freighter is a Stellar chrome extension.
TI-2021-12406 CVE-2021-32738 · GHSA-6cgh-hjpw-q3gq
Utils.readChallengeTx does not verify the server account signature
Priority LOW 29
js-stellar-sdk is a Javascript library for communicating with a Stellar Horizon server.