{"action":"Upgrade soroban-sdk to 22.0.9 or later.","affected":[{"fixed":"25.0.2","introduced":"25.0.0"},{"fixed":"23.5.1","introduced":"23.0.0"},{"fixed":"22.0.9","introduced":"0"}],"component":"soroban-sdk","cve_ids":["CVE-2026-24889"],"ecosystem":"crates.io","epss":0.00384,"exploited":false,"fixed_versions":["25.0.2","23.5.1","22.0.9"],"ghsa_id":"GHSA-96xm-fv9w-pf3f","id":"tcs_01M5KEW73A4291ES5Y5MZ6Q69S","modified_at":"2026-02-03T03:04:15.587576Z","published_at":"2026-01-28T22:20:35Z","references":["https://osv.dev/vulnerability/GHSA-96xm-fv9w-pf3f","https://github.com/stellar/rs-soroban-sdk/security/advisories/GHSA-96xm-fv9w-pf3f","https://nvd.nist.gov/vuln/detail/CVE-2026-24889","https://github.com/stellar/rs-soroban-sdk/pull/1703","https://github.com/stellar/rs-soroban-sdk/commit/3890521426d71bb4d892b21f5a283a1e836cfa38","https://github.com/stellar/rs-soroban-sdk/commit/59fcef437260ed4da42d1efb357137a5c166c02e","https://github.com/stellar/rs-soroban-sdk/commit/c2757c6d774dbb28b34a0b77ffe282e59f0f8462","https://github.com/stellar/rs-soroban-sdk","https://github.com/stellar/rs-soroban-sdk/releases/tag/v22.0.9","https://github.com/stellar/rs-soroban-sdk/releases/tag/v23.5.1","https://github.com/stellar/rs-soroban-sdk/releases/tag/v25.0.2"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-96xm-fv9w-pf3f","url":"https://osv.dev/vulnerability/GHSA-96xm-fv9w-pf3f"}],"summary":"soroban-sdk has overflow in Bytes::slice, Vec::slice, GenRange::gen_range for u64"}