{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-06-14T18:03:46.026","vulnerabilities":[{"cve":{"id":"CVE-2026-24889","sourceIdentifier":"security-advisories@github.com","published":"2026-01-28T22:15:56.700","lastModified":"2026-03-02T18:28:26.323","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"soroban-sdk is a Rust SDK for Soroban contracts. Arithmetic overflow can be triggered in the `Bytes::slice`, `Vec::slice`, and `Prng::gen_range` (for `u64`) methods in the `soroban-sdk` in versions up to and including `25.0.1`, `23.5.1`, and `25.0.2`. Contracts that pass user-controlled or computed range bounds to `Bytes::slice`, `Vec::slice`, or `Prng::gen_range` may silently operate on incorrect data ranges or generate random numbers from an unintended range, potentially resulting in corrupted contract state. Note that the best practice when using the `soroban-sdk` and building Soroban contracts is to always enable `overflow-checks = true`. The `stellar contract init` tool that prepares the boiler plate for a Soroban contract, as well as all examples and docs, encourage the use of configuring `overflow-checks = true` on `release` profiles so that these arithmetic operations fail rather than silently wrap. Contracts are only impacted if they use `overflow-checks = false` either explicitly or implicitly. It is anticipated the majority of contracts could not be impacted because the best practice encouraged by tooling is to enable `overflow-checks`. The fix available in `25.0.1`, `23.5.1`, and `25.0.2` replaces bare arithmetic with `checked_add` / `checked_sub`, ensuring overflow traps regardless of the `overflow-checks` profile setting. As a workaround, contract workspaces can be configured with a profile available in the GitHub Securtity Advisory to enable overflow checks on the arithmetic operations. This is the best practice when developing Soroban contracts, and the default if using the contract boilerplate generated using `stellar contract init`. Alternatively, contracts can validate range bounds before passing them to `slice` or `gen_range` to ensure the conversions cannot overflow."},{"lang":"es","value":"`soroban-sdk` es un SDK de Rust para contratos Soroban. El desbordamiento aritmético puede activarse en los métodos `Bytes::slice`, `Vec::slice` y `Prng::gen_range` (para `u64`) en el `soroban-sdk` en versiones hasta la `25.0.1`, `23.5.1` y `25.0.2` inclusive. Los contratos que pasan límites de rango controlados por el usuario o calculados a `Bytes::slice`, `Vec::slice` o `Prng::gen_range` pueden operar silenciosamente en rangos de datos incorrectos o generar números aleatorios de un rango no deseado, lo que podría resultar en un estado de contrato corrupto. Tenga en cuenta que la mejor práctica al usar el `soroban-sdk` y construir contratos Soroban es habilitar siempre `overflow-checks = true`. La herramienta `stellar contract init` que prepara el código base para un contrato Soroban, así como todos los ejemplos y la documentación, fomentan el uso de configurar `overflow-checks = true` en perfiles de `release` para que estas operaciones aritméticas fallen en lugar de envolverse silenciosamente. Los contratos solo se ven afectados si usan `overflow-checks = false` ya sea explícita o implícitamente. Se anticipa que la mayoría de los contratos no se verían afectados porque la mejor práctica fomentada por las herramientas es habilitar `overflow-checks`. La corrección disponible en `25.0.1`, `23.5.1` y `25.0.2` reemplaza la aritmética básica con `checked_add` / `checked_sub`, asegurando que los desbordamientos se intercepten independientemente de la configuración del perfil `overflow-checks`. Como solución alternativa, los espacios de trabajo de contratos pueden configurarse con un perfil disponible en el Aviso de Seguridad de GitHub para habilitar las comprobaciones de desbordamiento en las operaciones aritméticas. Esta es la mejor práctica al desarrollar contratos Soroban, y el valor predeterminado si se utiliza el código base del contrato generado con `stellar contract init`. Alternativamente, los contratos pueden validar los límites de rango antes de pasarlos a `slice` o `gen_range` para asegurar que las conversiones no puedan desbordarse."}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-190"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:stellar:rs-soroban-sdk:*:*:*:*:*:rust:*:*","versionEndExcluding":"22.0.9","matchCriteriaId":"A32F427A-2783-4BC4-8179-FA068687C74E"},{"vulnerable":true,"criteria":"cpe:2.3:a:stellar:rs-soroban-sdk:*:*:*:*:*:rust:*:*","versionStartIncluding":"23.0.0","versionEndExcluding":"23.5.1","matchCriteriaId":"007E2769-15DD-4508-90C5-B1FB89034D2D"},{"vulnerable":true,"criteria":"cpe:2.3:a:stellar:rs-soroban-sdk:*:*:*:*:*:rust:*:*","versionStartIncluding":"25.0.0","versionEndExcluding":"25.0.2","matchCriteriaId":"FE6977E5-17FB-4A06-BCF5-5ED52DFA5522"}]}]}],"references":[{"url":"https://github.com/stellar/rs-soroban-sdk/commit/3890521426d71bb4d892b21f5a283a1e836cfa38","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/stellar/rs-soroban-sdk/commit/59fcef437260ed4da42d1efb357137a5c166c02e","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/stellar/rs-soroban-sdk/commit/c2757c6d774dbb28b34a0b77ffe282e59f0f8462","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/stellar/rs-soroban-sdk/pull/1703","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/stellar/rs-soroban-sdk/releases/tag/v22.0.9","source":"security-advisories@github.com","tags":["Product","Release Notes"]},{"url":"https://github.com/stellar/rs-soroban-sdk/releases/tag/v23.5.1","source":"security-advisories@github.com","tags":["Product","Release Notes"]},{"url":"https://github.com/stellar/rs-soroban-sdk/releases/tag/v25.0.2","source":"security-advisories@github.com","tags":["Product","Release Notes"]},{"url":"https://github.com/stellar/rs-soroban-sdk/security/advisories/GHSA-96xm-fv9w-pf3f","source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory","Patch"]}]}}]}