stellar vulnerabilities

CVEs per yearBy the year they were published

1. 20211
2. 20232
3. 20241
4. 20265

Newest CVEs

• CVE-2026-32322

  soroban-sdk: `Fr` scalar field equality comparison bypasses modular reduction

  stellar · rs-soroban-sdk

  Medium5.3
• CVE-2026-32129

  Poseidon V1 variable-length input collision via implicit zero-padding

  stellar · rs-soroban-poseidon

  High8.7
• CVE-2026-29795

  stellar-xdr: `StringM::from_str` bypasses max length validation

  stellar · rs-stellar-xdr

  Medium4.0
• CVE-2026-26267

  rs-soroban-sdk #[contractimpl] macro calls inherent function instead of trait function when names collide

  stellar · rs-soroban-sdk

  High7.5
• CVE-2026-24889

  soroban-sdk has overflow in Bytes::slice, Vec::slice, GenRange::gen_range for u64

  stellar · rs-soroban-sdk

  Medium5.3
• CVE-2024-32985

  Stellar-core's Overlay - security fix for DDoS mitigation

  stellar · stellar-core

  Medium5.9
• CVE-2023-46135

  Panic in SignedPayload::from_payload

  stellar · rs-stellar-strkey

  Medium5.3
• CVE-2023-40580

  Freighter mnemonic phrase may be accessed by Javascript through a private API

  stellar · freighter

  High8.1
• CVE-2021-32738

  Utils.readChallengeTx does not verify the server account signature

  stellar · js-stellar-sdk

  Medium6.5