{"action":"Upgrade soroban-poseidon to 25.0.1 or later.","affected":[{"fixed":"25.0.1","introduced":"0"}],"component":"soroban-poseidon","cve_ids":["CVE-2026-32129"],"ecosystem":"crates.io","epss":0.00214,"exploited":false,"fixed_versions":["25.0.1"],"ghsa_id":"GHSA-g2p6-hh5v-7hfm","id":"tcs_01M5KEXQJW28HNYRM1WDKWWQ3C","modified_at":"2026-03-13T15:57:07.460394Z","published_at":"2026-03-13T15:40:31Z","references":["https://osv.dev/vulnerability/GHSA-g2p6-hh5v-7hfm","https://github.com/stellar/rs-soroban-poseidon/security/advisories/GHSA-g2p6-hh5v-7hfm","https://nvd.nist.gov/vuln/detail/CVE-2026-32129","https://github.com/stellar/rs-soroban-poseidon/pull/10","https://github.com/stellar/rs-soroban-poseidon/commit/ceb20d3593fc4a8a951a7e99d8fa2344f8250a8c","https://github.com/stellar/rs-soroban-poseidon","https://github.com/stellar/rs-soroban-poseidon/releases/tag/v25.0.1"],"severity":{"label":"high","score":8.7},"sources":[{"source":"osv","source_id":"GHSA-g2p6-hh5v-7hfm","url":"https://osv.dev/vulnerability/GHSA-g2p6-hh5v-7hfm"},{"source":"nvd","source_id":"CVE-2026-32129","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32129"}],"summary":"Poseidon V1 variable-length input collision via implicit zero-padding"}