Stellar vulnerabilities
We track 4 vulnerabilities in Stellar products across 5 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on March 12, 2026.
Latest Stellar vulnerabilities
- 8.7 High severity
rs-soroban-poseidon: Use of Weak Hash
soroban-poseidon provides Poseidon and Poseidon2 cryptographic hash functions for Soroban smart contracts. Poseidon V1 (PoseidonSponge) accepts variable-length inputs without injective padding. When a caller provides fewer inputs than the sponge rate (inputs.l
- 7.5 High severity
rs-stellar-xdr: Allocation of Resources Without Limits or Throttling
stellar-xdr is a library and CLI containing types and functionality for working with Stellar XDR. Prior to version 25.0.1, StringM::from_str does not validate that the input length is within the declared maximum (MAX). Calling StringM::<N>::from_str(s) where s
- 7.5 High severity
rs-soroban-sdk: Always-Incorrect Control Flow Implementation
soroban-sdk is a Rust SDK for Soroban contracts. Prior to versions 22.0.10, 23.5.2, and 25.1.1, the `#[contractimpl]` macro contains a bug in how it wires up function calls. `#[contractimpl]` generates code that uses `MyContract::value()` style calls even when
- 7.5 High severity
rs-stellar-strkey: Uncaught Exception
rs-stellar-strkey is a Rust lib for encode/decode of Stellar Strkeys. A panic vulnerability occurs when a specially crafted payload is used.`inner_payload_len` should not above 64. This vulnerability has been patched in version 0.0.8.