Skip to content
OpenAdvisories

Vendor

stellar

9 known vulnerabilities.

Products

rs-soroban-sdk 3 freighter 1 rs-stellar-xdr 1 js-stellar-sdk 1 stellar-core 1 rs-soroban-poseidon 1 rs-stellar-strkey 1
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-32322

    soroban-sdk: `Fr` scalar field equality comparison bypasses modular reduction

    soroban-sdk is a Rust SDK for Soroban contracts. Prior to 22.0.11, 23.5.3, and 25.3.0, The Fr (scalar field) types for BN254 and BLS12-381 in soroban-sdk compared values using their raw U256 representation without first reducing modulo the field modulus r. Th…

    stellar rs-soroban-sdk soroban-sdk crates.io
  • Medium 4.0
    CVE-2026-29795

    stellar-xdr: `StringM::from_str` bypasses max length validation

    stellar-xdr is a library and CLI containing types and functionality for working with Stellar XDR. Prior to version 25.0.1, StringM::from_str does not validate that the input length is within the declared maximum (MAX). Calling StringM::<N>::from_str(s) where …

    stellar rs-stellar-xdr stellar-xdr crates.io
  • Medium 5.3
    CVE-2026-24889

    soroban-sdk has overflow in Bytes::slice, Vec::slice, GenRange::gen_range for u64

    soroban-sdk is a Rust SDK for Soroban contracts. Arithmetic overflow can be triggered in the `Bytes::slice`, `Vec::slice`, and `Prng::gen_range` (for `u64`) methods in the `soroban-sdk` in versions up to and including `25.0.1`, `23.5.1`, and `25.0.2`. Contrac…

    stellar rs-soroban-sdk soroban-sdk crates.io
  • Medium 5.9
    CVE-2024-32985

    Stellar-core's Overlay - security fix for DDoS mitigation

    Stellar-core is a reference implementation for the peer-to-peer agent that manages the Stellar network. Prior to 20.4.0, core nodes could be randomly crashed due to a race condition with a 3rd party library. The likelihood of affecting the network is low sinc…

    stellar stellar-core
  • Medium 5.3
    CVE-2023-46135

    Panic in SignedPayload::from_payload

    rs-stellar-strkey is a Rust lib for encode/decode of Stellar Strkeys. A panic vulnerability occurs when a specially crafted payload is used.`inner_payload_len` should not above 64. This vulnerability has been patched in version 0.0.8.

    stellar rs-stellar-strkey stellar-strkey crates.io
  • Medium 6.5
    CVE-2021-32738

    Utils.readChallengeTx does not verify the server account signature

    js-stellar-sdk is a Javascript library for communicating with a Stellar Horizon server. The `Utils.readChallengeTx` function used in SEP-10 Stellar Web Authentication states in its function documentation that it reads and validates the challenge transaction i…

    stellar js-stellar-sdk stellar-sdk npm