CVE-2026-32322

soroban-sdk is a Rust SDK for Soroban contracts. Prior to 22.0.11, 23.5.3, and 25.3.0, The Fr (scalar field) types for BN254 and BLS12-381 in soroban-sdk compared values using their raw U256 representation without first reducing modulo the field modulus r. This caused mathematically equal field elements to compare as not-equal when one or both values were unreduced (i.e., >= r). The vulnerability requires an attacker to supply crafted Fr values through contract inputs, and compare them directly without going through host-side arithmetic operations. Smart contracts that rely on Fr equality checks for security-critical logic could produce incorrect results. The impact depends on how the affected contract uses Fr equality comparisons, but can result in incorrect authorization decisions or validation bypasses in contracts that perform equality checks on user-supplied scalar values. This vulnerability is fixed in 22.0.11, 23.5.3, and 25.3.0.

• CWE-697

• https://github.com/stellar/rs-soroban-sdk/security/advisories/GHSA-x2hw-px52-wp4mMitigation, Patch, Vendor Advisory

Published

Mar 13, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32316jq is a command-line JSON processor. An integer overflow vul…7.5
• CVE-2026-32317Cryptomator for Android offers multi-platform transparent cl…5.9
• CVE-2026-32318Cryptomator for IOS offers multi-platform transparent client…5.9
• CVE-2026-32319Ella Core is a 5G core designed for private networks. Prior …7.5
• CVE-2026-32320Ella Core is a 5G core designed for private networks. Prior …7.5
• CVE-2026-32321ClipBucket v5 is an open source video sharing platform. An a…8.8
• CVE-2026-32323Mullvad VPN is a VPN client app for desktop and mobile. When…7.8
• CVE-2026-32324Anviz CX7 Firmware is  vulnerable because the application em…7.7
• CVE-2026-32325Privilege chaining issue exists in ServerView Agents for Win…8.5
• CVE-2026-32326SHARP routers do not perform authentication for some web API…6.9
• CVE-2026-32327A bug in APR-util version 1.6.3 (and earlier) allows a stack…9.1
• CVE-2026-32328Cross-Site Request Forgery (CSRF) vulnerability in shuffleho…5.4