{"action":"Upgrade kora-lib to 2.0.5 or later.","affected":[{"fixed":"2.0.5","introduced":"0"}],"component":"kora-lib","cve_ids":[],"ecosystem":"crates.io","exploited":false,"fixed_versions":["2.0.5"],"ghsa_id":"GHSA-x442-m7cc-hr92","id":"tcs_01M5KF4FQN8ABJZ4Q2Q8JDCEMF","modified_at":"2026-03-14T02:59:57.822111Z","published_at":"2026-03-12T14:50:39Z","references":["https://osv.dev/vulnerability/GHSA-x442-m7cc-hr92","https://github.com/solana-foundation/kora/security/advisories/GHSA-x442-m7cc-hr92","https://github.com/solana-foundation/kora"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-x442-m7cc-hr92","url":"https://osv.dev/vulnerability/GHSA-x442-m7cc-hr92"}],"summary":"kora-lib: Unrecognized Instruction Types Create Empty Stubs That Bypass Fee Payer Policy"}