{"answers":{"affected":"6 open source packages ship an affected version, including soroban-sdk. It affects 1 product.","exploited":"There is no known exploitation of CVE-2026-32322 in the wild and no public exploit code.","fix":"Upgrade soroban-sdk to a fixed version for your release line: 22.0.11, 23.5.3 or 25.3.0.","what":"CVE-2026-32322 is a medium-severity vulnerability in stellar rs-soroban-sdk, published on 12 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-32322 and fix it if it is affected.\n\nWhat it is: CVE-2026-32322 is a medium-severity vulnerability in stellar rs-soroban-sdk, published on 12 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-32322 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- soroban-sdk (crates.io): affected all versions; fixed in 22.0.11\n- soroban-sdk (crates.io): affected all versions; fixed in 22.0.11\n- soroban-sdk (crates.io): affected from 23.0.0; fixed in 23.5.3\n- soroban-sdk (crates.io): affected from 23.0.0; fixed in 23.5.3\n- soroban-sdk (crates.io): affected from 25.0.0; fixed in 25.3.0\n- soroban-sdk (crates.io): affected from 25.0.0; fixed in 25.3.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-32322/ (Markdown: https://insights.sbomify.com/CVE-2026-32322/index.md)","id":"CVE-2026-32322","markdown":"https://insights.sbomify.com/CVE-2026-32322/index.md","name":"CVE-2026-32322","record":{"aliases":["GHSA-x2hw-px52-wp4m"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"Rust blockchain SDK","requires_auth":"none","summary":"Attackers can bypass security checks in Soroban smart contracts by exploiting incorrect equality comparisons of unreduced scalar field values.","user_interaction":"not_required","vuln_class":"business_logic"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"rs-soroban-sdk","vendor":"stellar"}],"cvss":{"score":5.3,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"cwes":[{"id":"CWE-697","name":"Incorrect Comparison"}],"description":"soroban-sdk is a Rust SDK for Soroban contracts. Prior to 22.0.11, 23.5.3, and 25.3.0, The Fr (scalar field) types for BN254 and BLS12-381 in soroban-sdk compared values using their raw U256 representation without first reducing modulo the field modulus r. This caused mathematically equal field elements to compare as not-equal when one or both values were unreduced (i.e., \u003e= r). The vulnerability requires an attacker to supply crafted Fr values through contract inputs, and compare them directly without going through host-side arithmetic operations. Smart contracts that rely on Fr equality checks for security-critical logic could produce incorrect results. The impact depends on how the affected contract uses Fr equality comparisons, but can result in incorrect authorization decisions or validation bypasses in contracts that perform equality checks on user-supplied scalar values. This vulnerability is fixed in 22.0.11, 23.5.3, and 25.3.0.","ecosystems":["crates.io"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"soroban-sdk: `Fr` scalar field equality comparison bypasses modular reduction","id":"CVE-2026-32322","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"crates.io","product":null,"products":[],"type":"business_logic","year":"2026"},"n_packages":6,"n_references":1,"next":{"headline":"Mullvad VPN for macOS: Local Privilege Escalation via unverified bundle path in installer","id":"CVE-2026-32323"},"packages":[{"ecosystem":"crates.io","fixed":["22.0.11"],"introduced":["0"],"last_affected":[],"package":"soroban-sdk","purl":null,"source":"GHSA-x2hw-px52-wp4m"},{"ecosystem":"crates.io","fixed":["22.0.11"],"introduced":["0"],"last_affected":[],"package":"soroban-sdk","purl":"pkg:cargo/soroban-sdk","source":"GHSA-x2hw-px52-wp4m"},{"ecosystem":"crates.io","fixed":["23.5.3"],"introduced":["23.0.0"],"last_affected":[],"package":"soroban-sdk","purl":null,"source":"GHSA-x2hw-px52-wp4m"},{"ecosystem":"crates.io","fixed":["23.5.3"],"introduced":["23.0.0"],"last_affected":[],"package":"soroban-sdk","purl":"pkg:cargo/soroban-sdk","source":"GHSA-x2hw-px52-wp4m"},{"ecosystem":"crates.io","fixed":["25.3.0"],"introduced":["25.0.0"],"last_affected":[],"package":"soroban-sdk","purl":null,"source":"GHSA-x2hw-px52-wp4m"},{"ecosystem":"crates.io","fixed":["25.3.0"],"introduced":["25.0.0"],"last_affected":[],"package":"soroban-sdk","purl":"pkg:cargo/soroban-sdk","source":"GHSA-x2hw-px52-wp4m"}],"prev":{"headline":"ClipBucket v5 has time-based Blind SQL Injection in ajax.php that leads to Data Exfiltration","id":"CVE-2026-32321"},"products":["rs-soroban-sdk"],"published":"2026-03-12","related":[{"cvss_score":7.5,"headline":"rs-soroban-sdk #[contractimpl] macro calls inherent function instead of trait function when names collide","id":"CVE-2026-26267","kev_date_added":null,"published":"2026-02-19"},{"cvss_score":5.3,"headline":"soroban-sdk has overflow in Bytes::slice, Vec::slice, GenRange::gen_range for u64","id":"CVE-2026-24889","kev_date_added":null,"published":"2026-01-28"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-03-13","vendors":["stellar"]},"summary":"Attackers can bypass security checks in Soroban smart contracts by exploiting incorrect equality comparisons of unreduced scalar field values.","url":"https://insights.sbomify.com/CVE-2026-32322/"}