{"answers":{"affected":"6 open source packages ship an affected version, including soroban-sdk. It affects 1 product.","exploited":"There is no known exploitation of CVE-2026-24889 in the wild and no public exploit code.","fix":"Upgrade soroban-sdk to a fixed version for your release line: 22.0.9, 23.5.1 or 25.0.2.","what":"CVE-2026-24889 is a medium-severity vulnerability in stellar rs-soroban-sdk, published on 28 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-24889 and fix it if it is affected.\n\nWhat it is: CVE-2026-24889 is a medium-severity vulnerability in stellar rs-soroban-sdk, published on 28 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-24889 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- soroban-sdk (crates.io): affected all versions; fixed in 22.0.9\n- soroban-sdk (crates.io): affected all versions; fixed in 22.0.9\n- soroban-sdk (crates.io): affected from 23.0.0; fixed in 23.5.1\n- soroban-sdk (crates.io): affected from 23.0.0; fixed in 23.5.1\n- soroban-sdk (crates.io): affected from 25.0.0; fixed in 25.0.2\n- soroban-sdk (crates.io): affected from 25.0.0; fixed in 25.0.2\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-24889/ (Markdown: https://insights.sbomify.com/CVE-2026-24889/index.md)","id":"CVE-2026-24889","markdown":"https://insights.sbomify.com/CVE-2026-24889/index.md","name":"CVE-2026-24889","record":{"aliases":["GHSA-96xm-fv9w-pf3f"],"analysis":{"component_type":"library","fix_type":"patch","impacts":["data_modify"],"network_reachable":"yes","non_default_config":true,"product_category":"Rust SDK for Soroban","requires_auth":"none","summary":"Integer overflow in slice and random generation methods can corrupt contract state if overflow checks are disabled.","user_interaction":"not_required","vuln_class":"integer_overflow"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"rs-soroban-sdk","vendor":"stellar"}],"cvss":{"score":5.3,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"cwes":[{"id":"CWE-190","name":"Integer Overflow or Wraparound"}],"description":"soroban-sdk is a Rust SDK for Soroban contracts. Arithmetic overflow can be triggered in the `Bytes::slice`, `Vec::slice`, and `Prng::gen_range` (for `u64`) methods in the `soroban-sdk` in versions up to and including `25.0.1`, `23.5.1`, and `25.0.2`. Contracts that pass user-controlled or computed range bounds to `Bytes::slice`, `Vec::slice`, or `Prng::gen_range` may silently operate on incorrect data ranges or generate random numbers from an unintended range, potentially resulting in corrupted contract state. Note that the best practice when using the `soroban-sdk` and building Soroban contracts is to always enable `overflow-checks = true`. The `stellar contract init` tool that prepares the boiler plate for a Soroban contract, as well as all examples and docs, encourage the use of configuring `overflow-checks = true` on `release` profiles so that these arithmetic operations fail rather than silently wrap. Contracts are only impacted if they use `overflow-checks = false` either explicitly or implicitly. It is anticipated the majority of contracts could not be impacted because the best practice encouraged by tooling is to enable `overflow-checks`. The fix available in `25.0.1`, `23.5.1`, and `25.0.2` replaces bare arithmetic with `checked_add` / `checked_sub`, ensuring overflow traps regardless of the `overflow-checks` profile setting. As a workaround, contract workspaces can be configured with a profile available in the GitHub Securtity Advisory to enable overflow checks on the arithmetic operations. This is the best practice when developing Soroban contracts, and the default if using the contract boilerplate generated using `stellar contract init`. Alternatively, contracts can validate range bounds before passing them to `slice` or `gen_range` to ensure the conversions cannot overflow.","ecosystems":["crates.io"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"soroban-sdk has overflow in Bytes::slice, Vec::slice, GenRange::gen_range for u64","id":"CVE-2026-24889","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"crates.io","product":null,"products":[],"type":"integer_overflow","year":"2026"},"n_packages":6,"n_references":8,"next":{"headline":"OpenEMR Portal Users Can Forge Provider Signatures","id":"CVE-2026-24890"},"packages":[{"ecosystem":"crates.io","fixed":["22.0.9"],"introduced":["0"],"last_affected":[],"package":"soroban-sdk","purl":null,"source":"GHSA-96xm-fv9w-pf3f"},{"ecosystem":"crates.io","fixed":["22.0.9"],"introduced":["0"],"last_affected":[],"package":"soroban-sdk","purl":"pkg:cargo/soroban-sdk","source":"GHSA-96xm-fv9w-pf3f"},{"ecosystem":"crates.io","fixed":["23.5.1"],"introduced":["23.0.0"],"last_affected":[],"package":"soroban-sdk","purl":null,"source":"GHSA-96xm-fv9w-pf3f"},{"ecosystem":"crates.io","fixed":["23.5.1"],"introduced":["23.0.0"],"last_affected":[],"package":"soroban-sdk","purl":"pkg:cargo/soroban-sdk","source":"GHSA-96xm-fv9w-pf3f"},{"ecosystem":"crates.io","fixed":["25.0.2"],"introduced":["25.0.0"],"last_affected":[],"package":"soroban-sdk","purl":null,"source":"GHSA-96xm-fv9w-pf3f"},{"ecosystem":"crates.io","fixed":["25.0.2"],"introduced":["25.0.0"],"last_affected":[],"package":"soroban-sdk","purl":"pkg:cargo/soroban-sdk","source":"GHSA-96xm-fv9w-pf3f"}],"prev":{"headline":"Maker.js Vulnerable to Unsafe Property Copying in makerjs.extendObject","id":"CVE-2026-24888"},"products":["rs-soroban-sdk"],"published":"2026-01-28","related":[{"cvss_score":7.5,"headline":"rs-soroban-sdk #[contractimpl] macro calls inherent function instead of trait function when names collide","id":"CVE-2026-26267","kev_date_added":null,"published":"2026-02-19"},{"cvss_score":5.3,"headline":"soroban-sdk: `Fr` scalar field equality comparison bypasses modular reduction","id":"CVE-2026-32322","kev_date_added":null,"published":"2026-03-12"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-01-29","vendors":["stellar"]},"summary":"Integer overflow in slice and random generation methods can corrupt contract state if overflow checks are disabled.","url":"https://insights.sbomify.com/CVE-2026-24889/"}