Vulnerability in Stellar Rs-soroban-sdk
CVE-2026-26267
soroban-sdk is a Rust SDK for Soroban contracts. Prior to versions 22.0.10, 23.5.2, and 25.1.1, the `#[contractimpl]` macro contains a bug in how it wires up function calls. `#[contractimpl]` generates code that uses `MyContract::value()`…
EPSS: 0.001 (16.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.
Affected products
- Stellar Rs-soroban-sdk — versions >= 25.0.0, < 25.1.1, >= 23.0.0, < 23.5.2, < 22.0.10
Weakness classification (CWE)
References
- https://github.com/stellar/rs-soroban-sdk/security/advisories/GHSA-4chv-4c6w-w254 (x_refsource_CONFIRM)
- https://github.com/stellar/rs-soroban-sdk/pull/1729 (x_refsource_MISC)
- https://github.com/stellar/rs-soroban-sdk/pull/1730 (x_refsource_MISC)
- https://github.com/stellar/rs-soroban-sdk/pull/1731 (x_refsource_MISC)
- https://github.com/stellar/rs-soroban-sdk/commit/e92a3933e5f92dc09da3c740cf6a360d55709a2b (x_refsource_MISC)
Frequently asked questions
- What is CVE-2026-26267?
- CVE-2026-26267 is a high-severity vulnerability in Stellar Rs-soroban-sdk, classified under Always-Incorrect Control Flow Implementation. CVSS score: 7.5/10. Published 2026-02-19.
- How severe is CVE-2026-26267?
- High severity. CVSS v3 base score is 7.5 out of 10.