CVE-2026-29795

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-29795", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-04T16:26:02.900Z", "datePublished": "2026-03-06T20:42:43.403Z", "dateUpdated": "2026-03-09T20:54:30.156Z"}, "containers": {"cna": {"title": "stellar-xdr: `StringM::from_str` bypasses max length validation", "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/stellar/rs-stellar-xdr/security/advisories/GHSA-x57h-xx53-v53w", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/stellar/rs-stellar-xdr/security/advisories/GHSA-x57h-xx53-v53w"}, {"name": "https://github.com/stellar/rs-stellar-xdr/issues/499", "tags": ["x_refsource_MISC"], "url": "https://github.com/stellar/rs-stellar-xdr/issues/499"}, {"name": "https://github.com/stellar/rs-stellar-xdr/pull/500", "tags": ["x_refsource_MISC"], "url": "https://github.com/stellar/rs-stellar-xdr/pull/500"}, {"name": "https://github.com/stellar/rs-stellar-xdr/commit/1f840013c3e2fca0321fb844b048afa01d10dda6", "tags": ["x_refsource_MISC"], "url": "https://github.com/stellar/rs-stellar-xdr/commit/1f840013c3e2fca0321fb844b048afa01d10dda6"}], "affected": [{"vendor": "stellar", "product": "rs-stellar-xdr", "versions": [{"version": "< 25.0.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-06T20:42:43.403Z"}, "descriptions": [{"lang": "en", "value": "stellar-xdr is a library and CLI containing types and functionality for working with Stellar XDR. Prior to version 25.0.1, StringM::from_str does not validate that the input length is within the declared maximum (MAX). Calling StringM::<N>::from_str(s) where s is longer than N bytes succeeds and returns an Ok value instead of Err(Error::LengthExceedsMax), producing a StringM that violates its length invariant. This affects any code that constructs StringM values from string input using FromStr (including str::parse), and relies on the type's maximum length constraint being enforced. An oversized StringM could propagate through serialization, validation, or other logic that assumes the invariant holds. This issue has been patched in version 25.0.1."}], "source": {"advisory": "GHSA-x57h-xx53-v53w", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-29795", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-09T20:49:57.353796Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T20:54:30.156Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-29795", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-09T20:49:57.353796Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T20:51:40.327Z"}}], "cna": {"title": "stellar-xdr: `StringM::from_str` bypasses max length validation", "source": {"advisory": "GHSA-x57h-xx53-v53w", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "stellar", "product": "rs-stellar-xdr", "versions": [{"status": "affected", "version": "< 25.0.1"}]}], "references": [{"url": "https://github.com/stellar/rs-stellar-xdr/security/advisories/GHSA-x57h-xx53-v53w", "name": "https://github.com/stellar/rs-stellar-xdr/security/advisories/GHSA-x57h-xx53-v53w", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/stellar/rs-stellar-xdr/issues/499", "name": "https://github.com/stellar/rs-stellar-xdr/issues/499", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/stellar/rs-stellar-xdr/pull/500", "name": "https://github.com/stellar/rs-stellar-xdr/pull/500", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/stellar/rs-stellar-xdr/commit/1f840013c3e2fca0321fb844b048afa01d10dda6", "name": "https://github.com/stellar/rs-stellar-xdr/commit/1f840013c3e2fca0321fb844b048afa01d10dda6", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "stellar-xdr is a library and CLI containing types and functionality for working with Stellar XDR. Prior to version 25.0.1, StringM::from_str does not validate that the input length is within the declared maximum (MAX). Calling StringM::<N>::from_str(s) where s is longer than N bytes succeeds and returns an Ok value instead of Err(Error::LengthExceedsMax), producing a StringM that violates its length invariant. This affects any code that constructs StringM values from string input using FromStr (including str::parse), and relies on the type's maximum length constraint being enforced. An oversized StringM could propagate through serialization, validation, or other logic that assumes the invariant holds. This issue has been patched in version 25.0.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-06T20:42:43.403Z"}}}, "cveMetadata": {"cveId": "CVE-2026-29795", "state": "PUBLISHED", "dateUpdated": "2026-03-09T20:54:30.156Z", "dateReserved": "2026-03-04T16:26:02.900Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-06T20:42:43.403Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "rs-stellar-xdr", "vendor": "stellar", "versions": [{"status": "affected", "version": "< 25.0.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:stellar:stellar-xdr:*:*:*:*:*:rust:*:*", "matchCriteriaId": "7DF08E48-746E-4AAE-B4F6-E9E8DE28E1B9", "versionEndExcluding": "25.0.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "stellar-xdr is a library and CLI containing types and functionality for working with Stellar XDR. Prior to version 25.0.1, StringM::from_str does not validate that the input length is within the declared maximum (MAX). Calling StringM::<N>::from_str(s) where s is longer than N bytes succeeds and returns an Ok value instead of Err(Error::LengthExceedsMax), producing a StringM that violates its length invariant. This affects any code that constructs StringM values from string input using FromStr (including str::parse), and relies on the type's maximum length constraint being enforced. An oversized StringM could propagate through serialization, validation, or other logic that assumes the invariant holds. This issue has been patched in version 25.0.1."}, {"lang": "es", "value": "stellar-xdr es una librer\u00eda y CLI que contiene tipos y funcionalidades para trabajar con Stellar XDR. Antes de la versi\u00f3n 25.0.1, StringM::from_str no valida que la longitud de entrada est\u00e9 dentro del m\u00e1ximo declarado (MAX). Llamar a StringM::::from_str(s) donde s es m\u00e1s largo que N bytes tiene \u00e9xito y devuelve un valor Ok en lugar de Err(Error::LengthExceedsMax), produciendo un StringM que viola su invariante de longitud. Esto afecta a cualquier c\u00f3digo que construye valores StringM a partir de una entrada de cadena usando FromStr (incluyendo str::parse), y que depende de que se aplique la restricci\u00f3n de longitud m\u00e1xima del tipo. Un StringM sobredimensionado podr\u00eda propagarse a trav\u00e9s de la serializaci\u00f3n, la validaci\u00f3n u otra l\u00f3gica que asume que el invariante se mantiene. Este problema ha sido parcheado en la versi\u00f3n 25.0.1."}], "id": "CVE-2026-29795", "lastModified": "2026-06-17T10:29:54.127", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-29795", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-09T20:49:57.353796Z", "version": "2.0.3"}}]}, "published": "2026-03-06T21:16:15.950", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/stellar/rs-stellar-xdr/commit/1f840013c3e2fca0321fb844b048afa01d10dda6"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking"], "url": "https://github.com/stellar/rs-stellar-xdr/issues/499"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/stellar/rs-stellar-xdr/pull/500"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Patch", "Vendor Advisory"], "url": "https://github.com/stellar/rs-stellar-xdr/security/advisories/GHSA-x57h-xx53-v53w"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,25.0.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "rs-stellar-xdr", "vendor": "stellar"}], "analysis": {"en": {"generated_at": "2026-04-16T11:12:05.739993+00:00", "value": {"mitigation_remediation": ["Update to rs\u2011stellar\u2011xdr 25.0.1 or newer, which includes the change to enforce max length validation.", "Identify any custom parsing or direct use of StringM::from_str / str::parse in your codebase and validate the length of input before calling the function or replace with safe alternatives that perform length checks.", "Review serialization and validation logic that consumes StringM values to ensure it properly handles unexpected length values and implements defensive checks against potential invariant violations."], "summary": {"action": "Patch Now", "impact": "Integrity (Invariant Violation)"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Stellar rs\u2011stellar-xdr library and CLI up to and including version 25.0.0. Systems that use this library to parse or construct XDR messages\u2014such as Stellar network nodes, client libraries, or any application that depends on rs\u2011stellar-xdr\u2014are impacted.", "description_and_impact": "StringM::from_str in the Stellar XDR library does not enforce the declared maximum length when constructing a StringM value. If an input string exceeds the allowed size, the function erroneously returns a successful result and produces a StringM that violates its length invariant. This flaw can allow callers to create malformed XDR structures that may bypass downstream validation, serialization, or other logic that assumes the invariant holds, potentially leading to logical inconsistencies, denial of service, or other integrity problems.", "risk_and_exploitability": "The CVSS score is 4.0, reflecting moderate severity. The EPSS score is below 1\u202f% and the issue is not listed in the CISA KEV catalog, indicating a low likelihood of active exploitation at present. However, because the flaw enables the creation of oversized StringM objects that can trick downstream code, an attacker with the ability to supply crafted input\u2014whether locally or remotely via an application that parses untrusted XDR\u2014could exploit the weakness. The attack would involve feeding an oversized string to StringM::<N>::from_str or str::parse, which the affected library accepts without error. Since the flaw lies in the library itself and does not require additional conditions, its exploitability remains contingent on whether the vulnerable code path is invoked."}}}}, "created": "2026-03-09T10:06:57.535797+00:00", "updated": "2026-04-16T11:15:27.689601+00:00", "vendors": ["stellar", "stellar$PRODUCT$rs-stellar-xdr"]}