stellar rs-soroban-sdk up to 22.0.8/23.5.0/25.0.1 gen_range integer overflow

Summaryinfo

A vulnerability was found in stellar rs-soroban-sdk up to 22.0.8/23.5.0/25.0.1. It has been declared as problematic. The impacted element is the function Bytes::slice/Vec::slice/Prng::gen_range. Such manipulation leads to integer overflow. This vulnerability is listed as CVE-2026-24889. The attack may be performed from remote. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in stellar rs-soroban-sdk up to 22.0.8/23.5.0/25.0.1 and classified as problematic. Affected by this issue is the function Bytes::slice/Vec::slice/Prng::gen_range. The manipulation with an unknown input leads to a integer overflow vulnerability. Using CWE to declare the problem leads to CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control. Impacted is integrity. CVE summarizes:

soroban-sdk is a Rust SDK for Soroban contracts. Arithmetic overflow can be triggered in the `Bytes::slice`, `Vec::slice`, and `Prng::gen_range` (for `u64`) methods in the `soroban-sdk` in versions up to and including `25.0.1`, `23.5.1`, and `25.0.2`. Contracts that pass user-controlled or computed range bounds to `Bytes::slice`, `Vec::slice`, or `Prng::gen_range` may silently operate on incorrect data ranges or generate random numbers from an unintended range, potentially resulting in corrupted contract state. Note that the best practice when using the `soroban-sdk` and building Soroban contracts is to always enable `overflow-checks = true`. The `stellar contract init` tool that prepares the boiler plate for a Soroban contract, as well as all examples and docs, encourage the use of configuring `overflow-checks = true` on `release` profiles so that these arithmetic operations fail rather than silently wrap. Contracts are only impacted if they use `overflow-checks = false` either explicitly or implicitly. It is anticipated the majority of contracts could not be impacted because the best practice encouraged by tooling is to enable `overflow-checks`. The fix available in `25.0.1`, `23.5.1`, and `25.0.2` replaces bare arithmetic with `checked_add` / `checked_sub`, ensuring overflow traps regardless of the `overflow-checks` profile setting. As a workaround, contract workspaces can be configured with a profile available in the GitHub Securtity Advisory to enable overflow checks on the arithmetic operations. This is the best practice when developing Soroban contracts, and the default if using the contract boilerplate generated using `stellar contract init`. Alternatively, contracts can validate range bounds before passing them to `slice` or `gen_range` to ensure the conversions cannot overflow.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-24889 since 01/27/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available.

Upgrading to version 22.0.9, 23.5.1 or 25.0.2 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 3890521426d71bb4d892b21f5a283a1e836cfa38 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-4848). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• stellar

Name

• rs-soroban-sdk

Version

• 22.0.0
• 22.0.1
• 22.0.2
• 22.0.3
• 22.0.4
• 22.0.5
• 22.0.6
• 22.0.7
• 22.0.8
• 23.0
• 23.1
• 23.2
• 23.3
• 23.4
• 23.5.0
• 25.0.0
• 25.0.1

License

• open-source

Website

• Product: https://github.com/stellar/rs-soroban-sdk/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion