Skip to content
OpenAdvisories

Vendor

stellar

9 known vulnerabilities.

Products

rs-soroban-sdk 3 freighter 1 rs-stellar-xdr 1 js-stellar-sdk 1 stellar-core 1 rs-soroban-poseidon 1 rs-stellar-strkey 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.7
    CVE-2026-32129

    Poseidon V1 variable-length input collision via implicit zero-padding

    soroban-poseidon provides Poseidon and Poseidon2 cryptographic hash functions for Soroban smart contracts. Poseidon V1 (PoseidonSponge) accepts variable-length inputs without injective padding. When a caller provides fewer inputs than the sponge rate (inputs.…

    stellar rs-soroban-poseidon soroban-poseidon crates.io
  • High 7.5
    CVE-2026-26267

    rs-soroban-sdk #[contractimpl] macro calls inherent function instead of trait function when names collide

    soroban-sdk is a Rust SDK for Soroban contracts. Prior to versions 22.0.10, 23.5.2, and 25.1.1, the `#[contractimpl]` macro contains a bug in how it wires up function calls. `#[contractimpl]` generates code that uses `MyContract::value()` style calls even whe…

    stellar rs-soroban-sdk soroban-sdk-macros crates.io
  • High 8.1
    CVE-2023-40580

    Freighter mnemonic phrase may be accessed by Javascript through a private API

    Freighter is a Stellar chrome extension. It may be possible for a malicious website to access the recovery mnemonic phrase when the Freighter wallet is unlocked. This vulnerability impacts access control to the mnemonic recovery phrase. This issue was patched…

    stellar freighter