Stellar
9 CVEs across 8 Stellar products. Browse Stellar vulnerabilities, severities, and proof-of-concept exploits.
Stellar products with known CVEs
Stellar CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2026-32322 | Medium | 5.3 | 2026-03-13 | soroban-sdk is a Rust SDK for Soroban contracts. Prior to 22.0.11, 23.5.3, and 25.3.0, The Fr (scalar field) types for BN254 and BLS12-381 in soroban-sdk compa… |
CVE-2026-32129 | | | 2026-03-12 | soroban-poseidon provides Poseidon and Poseidon2 cryptographic hash functions for Soroban smart contracts. Poseidon V1 (PoseidonSponge) accepts variable-length… |
CVE-2026-29795 | Medium | 4.0 | 2026-03-06 | stellar-xdr is a library and CLI containing types and functionality for working with Stellar XDR. Prior to version 25.0.1, StringM::from_str does not validate… |
CVE-2026-26267 | High | 7.5 | 2026-02-19 | soroban-sdk is a Rust SDK for Soroban contracts. Prior to versions 22.0.10, 23.5.2, and 25.1.1, the `#[contractimpl]` macro contains a bug in how it wires up f… |
CVE-2026-24889 | Medium | 5.3 | 2026-01-28 | soroban-sdk is a Rust SDK for Soroban contracts. Arithmetic overflow can be triggered in the `Bytes::slice`, `Vec::slice`, and `Prng::gen_range` (for `u64`) me… |
CVE-2024-32985 | Medium | 5.9 | 2024-05-14 | Stellar-core is a reference implementation for the peer-to-peer agent that manages the Stellar network. Prior to 20.4.0, core nodes could be randomly crashed d… |
CVE-2023-46135 | Medium | 5.3 | 2023-10-25 | rs-stellar-strkey is a Rust lib for encode/decode of Stellar Strkeys. A panic vulnerability occurs when a specially crafted payload is used.`inner_payload_len`… |
CVE-2023-40580 | High | 8.1 | 2023-08-25 | Freighter is a Stellar chrome extension. It may be possible for a malicious website to access the recovery mnemonic phrase when the Freighter wallet is unlocke… |
CVE-2021-32738 | Medium | 6.5 | 2021-07-02 | js-stellar-sdk is a Javascript library for communicating with a Stellar Horizon server. The `Utils.readChallengeTx` function used in SEP-10 Stellar Web Authent… |