crates.io/stellar-xdr CVE-2026-29795: medium 4, EPSS 0.36%

stellar-xdr's StringM::from_str bypasses max length validation

Action: Upgrade stellar-xdr to 25.0.1 or later.

cargo update -p stellar-xdr --precise 25.0.1

Affected

Fixed versions

Sources

• osv: GHSA-x57h-xx53-v53w
• https://github.com/stellar/rs-stellar-xdr/security/advisories/GHSA-x57h-xx53-v53w
• https://nvd.nist.gov/vuln/detail/CVE-2026-29795
• https://github.com/stellar/rs-stellar-xdr/issues/499
• https://github.com/stellar/rs-stellar-xdr/pull/500
• https://github.com/stellar/rs-stellar-xdr/commit/1f840013c3e2fca0321fb844b048afa01d10dda6
• https://github.com/stellar/rs-stellar-xdr

CVE-2026-29795 · published 2026-03-05T20:45:46Z · modified 2026-03-06T23:02:40.557695Z · JSON