CVE-2026-26267
1 advisory.
crates.io/soroban-sdk-macros CVE-2026-26267: high 7.5
The rs-soroban-sdk #[contractimpl] macro calls inherent function instead of trait function when names collide
Action: Upgrade soroban-sdk-macros to 22.0.10 or later.
cargo update -p soroban-sdk-macros --precise 25.1.1cargo update -p soroban-sdk-macros --precise 23.5.2cargo update -p soroban-sdk-macros --precise 22.0.10Affected
| introduced | fixed | last affected |
|---|---|---|
| 25.0.0 | 25.1.1 | - |
| 23.0.0 | 23.5.2 | - |
| 0 | 22.0.10 | - |
Fixed versions
| 25.1.1 | 23.5.2 | 22.0.10 |
Sources
- osv: GHSA-4chv-4c6w-w254
- https://github.com/stellar/rs-soroban-sdk/security/advisories/GHSA-4chv-4c6w-w254
- https://nvd.nist.gov/vuln/detail/CVE-2026-26267
- https://github.com/stellar/rs-soroban-sdk/pull/1729
- https://github.com/stellar/rs-soroban-sdk/pull/1730
- https://github.com/stellar/rs-soroban-sdk/pull/1731
- https://github.com/stellar/rs-soroban-sdk/commit/e92a3933e5f92dc09da3c740cf6a360d55709a2b
- https://github.com/stellar/rs-soroban-sdk
CVE-2026-26267 · published · modified · JSON