Threats affecting pkg:cargo/github/stellar/rs-soroban-sdk

CVE-2026-32322 is a medium severity vulnerability in the stellar rs-soroban-sdk, a Rust SDK for Soroban smart contracts. The flaw arises from incorrect equality comparisons of Fr (scalar field) types for BN254 and BLS12-381 curves, where values are compared using their raw U256 representation without modular reduction. This causes mathematically equal field elements to be treated as unequal if unreduced, potentially leading to incorrect authorization or validation bypasses in smart contracts relying on these checks. Exploitation requires an attacker to supply crafted Fr values as contract inputs and depends on the contract performing direct equality checks on these values. The vulnerability affects versions prior to 22.0.11, 23.5.3, and 25.3.

CVE-2026-24889 is an integer overflow vulnerability in the Stellar rs-soroban-sdk Rust SDK used for Soroban smart contracts. The flaw occurs in the Bytes::slice, Vec::slice, and Prng::gen_range methods when user-controlled or computed range bounds cause arithmetic overflow or wraparound, potentially corrupting contract state or generating unintended random numbers. This vulnerability affects versions prior to 22.0.9, between 23.0.0 and 23.5.1, and between 25.0.