CVE-2026-24889

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24889", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-27T19:35:20.528Z", "datePublished": "2026-01-28T22:01:00.374Z", "dateUpdated": "2026-01-29T18:00:47.472Z"}, "containers": {"cna": {"title": "soroban-sdk has overflow in Bytes::slice, Vec::slice, GenRange::gen_range for u64", "problemTypes": [{"descriptions": [{"cweId": "CWE-190", "lang": "en", "description": "CWE-190: Integer Overflow or Wraparound", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/stellar/rs-soroban-sdk/security/advisories/GHSA-96xm-fv9w-pf3f", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/stellar/rs-soroban-sdk/security/advisories/GHSA-96xm-fv9w-pf3f"}, {"name": "https://github.com/stellar/rs-soroban-sdk/pull/1703", "tags": ["x_refsource_MISC"], "url": "https://github.com/stellar/rs-soroban-sdk/pull/1703"}, {"name": "https://github.com/stellar/rs-soroban-sdk/commit/3890521426d71bb4d892b21f5a283a1e836cfa38", "tags": ["x_refsource_MISC"], "url": "https://github.com/stellar/rs-soroban-sdk/commit/3890521426d71bb4d892b21f5a283a1e836cfa38"}, {"name": "https://github.com/stellar/rs-soroban-sdk/commit/59fcef437260ed4da42d1efb357137a5c166c02e", "tags": ["x_refsource_MISC"], "url": "https://github.com/stellar/rs-soroban-sdk/commit/59fcef437260ed4da42d1efb357137a5c166c02e"}, {"name": "https://github.com/stellar/rs-soroban-sdk/commit/c2757c6d774dbb28b34a0b77ffe282e59f0f8462", "tags": ["x_refsource_MISC"], "url": "https://github.com/stellar/rs-soroban-sdk/commit/c2757c6d774dbb28b34a0b77ffe282e59f0f8462"}, {"name": "https://github.com/stellar/rs-soroban-sdk/releases/tag/v22.0.9", "tags": ["x_refsource_MISC"], "url": "https://github.com/stellar/rs-soroban-sdk/releases/tag/v22.0.9"}, {"name": "https://github.com/stellar/rs-soroban-sdk/releases/tag/v23.5.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/stellar/rs-soroban-sdk/releases/tag/v23.5.1"}, {"name": "https://github.com/stellar/rs-soroban-sdk/releases/tag/v25.0.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/stellar/rs-soroban-sdk/releases/tag/v25.0.2"}], "affected": [{"vendor": "stellar", "product": "rs-soroban-sdk", "versions": [{"version": "< 22.0.9", "status": "affected"}, {"version": ">= 23.0.0, < 23.5.1", "status": "affected"}, {"version": ">= 25.0.0, < 25.0.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-28T22:01:00.374Z"}, "descriptions": [{"lang": "en", "value": "soroban-sdk is a Rust SDK for Soroban contracts. Arithmetic overflow can be triggered in the `Bytes::slice`, `Vec::slice`, and `Prng::gen_range` (for `u64`) methods in the `soroban-sdk` in versions up to and including `25.0.1`, `23.5.1`, and `25.0.2`. Contracts that pass user-controlled or computed range bounds to `Bytes::slice`, `Vec::slice`, or `Prng::gen_range` may silently operate on incorrect data ranges or generate random numbers from an unintended range, potentially resulting in corrupted contract state. Note that the best practice when using the `soroban-sdk` and building Soroban contracts is to always enable `overflow-checks = true`. The `stellar contract init` tool that prepares the boiler plate for a Soroban contract, as well as all examples and docs, encourage the use of configuring `overflow-checks = true` on `release` profiles so that these arithmetic operations fail rather than silently wrap. Contracts are only impacted if they use `overflow-checks = false` either explicitly or implicitly. It is anticipated the majority of contracts could not be impacted because the best practice encouraged by tooling is to enable `overflow-checks`. The fix available in `25.0.1`, `23.5.1`, and `25.0.2` replaces bare arithmetic with `checked_add` / `checked_sub`, ensuring overflow traps regardless of the `overflow-checks` profile setting. As a workaround, contract workspaces can be configured with a profile available in the GitHub Securtity Advisory to enable overflow checks on the arithmetic operations. This is the best practice when developing Soroban contracts, and the default if using the contract boilerplate generated using `stellar contract init`. Alternatively, contracts can validate range bounds before passing them to `slice` or `gen_range` to ensure the conversions cannot overflow."}], "source": {"advisory": "GHSA-96xm-fv9w-pf3f", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-29T16:01:43.687365Z", "id": "CVE-2026-24889", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-29T18:00:47.472Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24889", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-29T16:01:43.687365Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-29T16:01:49.029Z"}}], "cna": {"title": "soroban-sdk has overflow in Bytes::slice, Vec::slice, GenRange::gen_range for u64", "source": {"advisory": "GHSA-96xm-fv9w-pf3f", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "stellar", "product": "rs-soroban-sdk", "versions": [{"status": "affected", "version": "< 22.0.9"}, {"status": "affected", "version": ">= 23.0.0, < 23.5.1"}, {"status": "affected", "version": ">= 25.0.0, < 25.0.2"}]}], "references": [{"url": "https://github.com/stellar/rs-soroban-sdk/security/advisories/GHSA-96xm-fv9w-pf3f", "name": "https://github.com/stellar/rs-soroban-sdk/security/advisories/GHSA-96xm-fv9w-pf3f", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/stellar/rs-soroban-sdk/pull/1703", "name": "https://github.com/stellar/rs-soroban-sdk/pull/1703", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/stellar/rs-soroban-sdk/commit/3890521426d71bb4d892b21f5a283a1e836cfa38", "name": "https://github.com/stellar/rs-soroban-sdk/commit/3890521426d71bb4d892b21f5a283a1e836cfa38", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/stellar/rs-soroban-sdk/commit/59fcef437260ed4da42d1efb357137a5c166c02e", "name": "https://github.com/stellar/rs-soroban-sdk/commit/59fcef437260ed4da42d1efb357137a5c166c02e", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/stellar/rs-soroban-sdk/commit/c2757c6d774dbb28b34a0b77ffe282e59f0f8462", "name": "https://github.com/stellar/rs-soroban-sdk/commit/c2757c6d774dbb28b34a0b77ffe282e59f0f8462", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/stellar/rs-soroban-sdk/releases/tag/v22.0.9", "name": "https://github.com/stellar/rs-soroban-sdk/releases/tag/v22.0.9", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/stellar/rs-soroban-sdk/releases/tag/v23.5.1", "name": "https://github.com/stellar/rs-soroban-sdk/releases/tag/v23.5.1", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/stellar/rs-soroban-sdk/releases/tag/v25.0.2", "name": "https://github.com/stellar/rs-soroban-sdk/releases/tag/v25.0.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "soroban-sdk is a Rust SDK for Soroban contracts. Arithmetic overflow can be triggered in the `Bytes::slice`, `Vec::slice`, and `Prng::gen_range` (for `u64`) methods in the `soroban-sdk` in versions up to and including `25.0.1`, `23.5.1`, and `25.0.2`. Contracts that pass user-controlled or computed range bounds to `Bytes::slice`, `Vec::slice`, or `Prng::gen_range` may silently operate on incorrect data ranges or generate random numbers from an unintended range, potentially resulting in corrupted contract state. Note that the best practice when using the `soroban-sdk` and building Soroban contracts is to always enable `overflow-checks = true`. The `stellar contract init` tool that prepares the boiler plate for a Soroban contract, as well as all examples and docs, encourage the use of configuring `overflow-checks = true` on `release` profiles so that these arithmetic operations fail rather than silently wrap. Contracts are only impacted if they use `overflow-checks = false` either explicitly or implicitly. It is anticipated the majority of contracts could not be impacted because the best practice encouraged by tooling is to enable `overflow-checks`. The fix available in `25.0.1`, `23.5.1`, and `25.0.2` replaces bare arithmetic with `checked_add` / `checked_sub`, ensuring overflow traps regardless of the `overflow-checks` profile setting. As a workaround, contract workspaces can be configured with a profile available in the GitHub Securtity Advisory to enable overflow checks on the arithmetic operations. This is the best practice when developing Soroban contracts, and the default if using the contract boilerplate generated using `stellar contract init`. Alternatively, contracts can validate range bounds before passing them to `slice` or `gen_range` to ensure the conversions cannot overflow."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "CWE-190: Integer Overflow or Wraparound"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-28T22:01:00.374Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24889", "state": "PUBLISHED", "dateUpdated": "2026-01-29T18:00:47.472Z", "dateReserved": "2026-01-27T19:35:20.528Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-28T22:01:00.374Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "rs-soroban-sdk", "vendor": "stellar", "versions": [{"status": "affected", "version": "< 22.0.9"}, {"status": "affected", "version": ">= 23.0.0, < 23.5.1"}, {"status": "affected", "version": ">= 25.0.0, < 25.0.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:stellar:rs-soroban-sdk:*:*:*:*:*:rust:*:*", "matchCriteriaId": "A32F427A-2783-4BC4-8179-FA068687C74E", "versionEndExcluding": "22.0.9", "vulnerable": true}, {"criteria": "cpe:2.3:a:stellar:rs-soroban-sdk:*:*:*:*:*:rust:*:*", "matchCriteriaId": "007E2769-15DD-4508-90C5-B1FB89034D2D", "versionEndExcluding": "23.5.1", "versionStartIncluding": "23.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:stellar:rs-soroban-sdk:*:*:*:*:*:rust:*:*", "matchCriteriaId": "FE6977E5-17FB-4A06-BCF5-5ED52DFA5522", "versionEndExcluding": "25.0.2", "versionStartIncluding": "25.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "soroban-sdk is a Rust SDK for Soroban contracts. Arithmetic overflow can be triggered in the `Bytes::slice`, `Vec::slice`, and `Prng::gen_range` (for `u64`) methods in the `soroban-sdk` in versions up to and including `25.0.1`, `23.5.1`, and `25.0.2`. Contracts that pass user-controlled or computed range bounds to `Bytes::slice`, `Vec::slice`, or `Prng::gen_range` may silently operate on incorrect data ranges or generate random numbers from an unintended range, potentially resulting in corrupted contract state. Note that the best practice when using the `soroban-sdk` and building Soroban contracts is to always enable `overflow-checks = true`. The `stellar contract init` tool that prepares the boiler plate for a Soroban contract, as well as all examples and docs, encourage the use of configuring `overflow-checks = true` on `release` profiles so that these arithmetic operations fail rather than silently wrap. Contracts are only impacted if they use `overflow-checks = false` either explicitly or implicitly. It is anticipated the majority of contracts could not be impacted because the best practice encouraged by tooling is to enable `overflow-checks`. The fix available in `25.0.1`, `23.5.1`, and `25.0.2` replaces bare arithmetic with `checked_add` / `checked_sub`, ensuring overflow traps regardless of the `overflow-checks` profile setting. As a workaround, contract workspaces can be configured with a profile available in the GitHub Securtity Advisory to enable overflow checks on the arithmetic operations. This is the best practice when developing Soroban contracts, and the default if using the contract boilerplate generated using `stellar contract init`. Alternatively, contracts can validate range bounds before passing them to `slice` or `gen_range` to ensure the conversions cannot overflow."}, {"lang": "es", "value": "`soroban-sdk` es un SDK de Rust para contratos Soroban. El desbordamiento aritm\u00e9tico puede activarse en los m\u00e9todos `Bytes::slice`, `Vec::slice` y `Prng::gen_range` (para `u64`) en el `soroban-sdk` en versiones hasta la `25.0.1`, `23.5.1` y `25.0.2` inclusive. Los contratos que pasan l\u00edmites de rango controlados por el usuario o calculados a `Bytes::slice`, `Vec::slice` o `Prng::gen_range` pueden operar silenciosamente en rangos de datos incorrectos o generar n\u00fameros aleatorios de un rango no deseado, lo que podr\u00eda resultar en un estado de contrato corrupto. Tenga en cuenta que la mejor pr\u00e1ctica al usar el `soroban-sdk` y construir contratos Soroban es habilitar siempre `overflow-checks = true`. La herramienta `stellar contract init` que prepara el c\u00f3digo base para un contrato Soroban, as\u00ed como todos los ejemplos y la documentaci\u00f3n, fomentan el uso de configurar `overflow-checks = true` en perfiles de `release` para que estas operaciones aritm\u00e9ticas fallen en lugar de envolverse silenciosamente. Los contratos solo se ven afectados si usan `overflow-checks = false` ya sea expl\u00edcita o impl\u00edcitamente. Se anticipa que la mayor\u00eda de los contratos no se ver\u00edan afectados porque la mejor pr\u00e1ctica fomentada por las herramientas es habilitar `overflow-checks`. La correcci\u00f3n disponible en `25.0.1`, `23.5.1` y `25.0.2` reemplaza la aritm\u00e9tica b\u00e1sica con `checked_add` / `checked_sub`, asegurando que los desbordamientos se intercepten independientemente de la configuraci\u00f3n del perfil `overflow-checks`. Como soluci\u00f3n alternativa, los espacios de trabajo de contratos pueden configurarse con un perfil disponible en el Aviso de Seguridad de GitHub para habilitar las comprobaciones de desbordamiento en las operaciones aritm\u00e9ticas. Esta es la mejor pr\u00e1ctica al desarrollar contratos Soroban, y el valor predeterminado si se utiliza el c\u00f3digo base del contrato generado con `stellar contract init`. Alternativamente, los contratos pueden validar los l\u00edmites de rango antes de pasarlos a `slice` o `gen_range` para asegurar que las conversiones no puedan desbordarse."}], "id": "CVE-2026-24889", "lastModified": "2026-06-17T10:23:45.297", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24889", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-29T16:01:43.687365Z", "version": "2.0.3"}}]}, "published": "2026-01-28T22:15:56.700", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/stellar/rs-soroban-sdk/commit/3890521426d71bb4d892b21f5a283a1e836cfa38"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/stellar/rs-soroban-sdk/commit/59fcef437260ed4da42d1efb357137a5c166c02e"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/stellar/rs-soroban-sdk/commit/c2757c6d774dbb28b34a0b77ffe282e59f0f8462"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/stellar/rs-soroban-sdk/pull/1703"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/stellar/rs-soroban-sdk/releases/tag/v22.0.9"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/stellar/rs-soroban-sdk/releases/tag/v23.5.1"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/stellar/rs-soroban-sdk/releases/tag/v25.0.2"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Patch", "Vendor Advisory"], "url": "https://github.com/stellar/rs-soroban-sdk/security/advisories/GHSA-96xm-fv9w-pf3f"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T01:34:41.877537+00:00", "value": {"mitigation_remediation": ["Upgrade affected rs\u2011soroban\u2011sdk components to a fixed release such as v25.0.2, v23.5.1, or v25.0.1", "Enable the Rust compiler flag `overflow-checks = true` in the release profile used to build contracts so that the arithmetic operations trap on overflow", "Validate or constrain range bounds before calling `slice` or `gen_range` to prevent values that could overflow"], "summary": {"action": "Patch SDK", "impact": "Contract State Corruption"}, "threat_synthesis": {"affected_systems": "Affected systems are those built on Stellar's rs\u2011soroban\u2011sdk library. The vulnerability exists in SDK releases up to and including 25.0.1, 23.5.1, and 25.0.2. Contracts or tools that depend on those specific versions are at risk unless they have been upgraded or otherwise mitigated. The latest published releases (for example 25.0.2 and 23.5.1) contain a patch that replaces bare arithmetic with checked operations to trap overflows regardless of the overflow\u2011checks setting.", "description_and_impact": "Arithmetic overflow occurs in soroban-sdk's Bytes::slice, Vec::slice, and Prng::gen_range (u64) methods for versions up to 25.0.1, 23.5.1, and 25.0.2. The overflow can be triggered when user\u2011controlled or computed range bounds are passed, causing the library to use incorrect data ranges or generate random numbers from an unintended range. In Rust releases that compile without overflow checks, the overflow silently wraps, potentially corrupting contract state. This weakness is identified as integer overflow (CWE\u2011190) and can lead to data corruption or unintended behavior within Soroban contracts.", "risk_and_exploitability": "CVSS score of 5.3 indicates a medium\u2011level severity, and the EPSS score is below 1\u202f%, suggesting low probability of exploitation. The vulnerability is not listed as a known exploited vulnerability by CISA. The attack vector depends on whether the contract author compiles with `overflow-checks = false`; an attacker that can influence the range bounds passed to the vulnerable methods could cause silent data or state manipulation, but success requires code\u2011level control or a malicious contract author. Enabling `overflow-checks = true` or using the latest patched SDK mitigates the risk by forcing panics or corrected arithmetic. Therefore, the overall risk to existing contracts is moderate, with the main concern being potential state corruption if unchecked arithmetic is used."}}}}, "created": "2026-01-29T09:08:38.824666+00:00", "updated": "2026-04-18T01:45:33.391867+00:00", "vendors": ["stellar", "stellar$PRODUCT$rs-soroban-sdk"]}