Threats affecting pkg:cargo/github/stellar/rs-soroban-poseidon

CVE-2026-32129 is a high-severity vulnerability in the stellar rs-soroban-poseidon library, specifically affecting the Poseidon V1 (PoseidonSponge) cryptographic hash function used in Soroban smart contracts. The issue arises because PoseidonSponge accepts variable-length inputs without injective padding, implicitly zero-filling unused rate positions when fewer inputs than the sponge rate are provided. This leads to trivial hash collisions where hash([m1, ... , mk]) equals hash([m1, ... , mk, 0]), undermining the hash function's collision resistance. Poseidon2 (Poseidon2Sponge) is not affected. The vulnerability has a CVSS 4.0 score of 8.7, indicating high severity, and does not require authentication or user interaction to exploit. No known exploits are currently reported in the wild.