Vulnerability-Lookup

CVE-2026-29795 (GCVE-0-2026-29795)

Vulnerability from cvelistv5 – Published: 2026-03-06 20:42 – Updated: 2026-03-09 20:54

Title

stellar-xdr: `StringM::from_str` bypasses max length validation

Summary

stellar-xdr is a library and CLI containing types and functionality for working with Stellar XDR. Prior to version 25.0.1, StringM::from_str does not validate that the input length is within the declared maximum (MAX). Calling StringM::<N>::from_str(s) where s is longer than N bytes succeeds and returns an Ok value instead of Err(Error::LengthExceedsMax), producing a StringM that violates its length invariant. This affects any code that constructs StringM values from string input using FromStr (including str::parse), and relies on the type's maximum length constraint being enforced. An oversized StringM could propagate through serialization, validation, or other logic that assumes the invariant holds. This issue has been patched in version 25.0.1.

Severity ?

4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M

References

URL

Tags

	https://github.com/stellar/rs-stellar-xdr/securit…	x_refsource_CONFIRM
	https://github.com/stellar/rs-stellar-xdr/issues/499	x_refsource_MISC
	https://github.com/stellar/rs-stellar-xdr/pull/500	x_refsource_MISC
	https://github.com/stellar/rs-stellar-xdr/commit/…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	stellar	rs-stellar-xdr	Affected: < 25.0.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-29795",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-09T20:49:57.353796Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-09T20:54:30.156Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "rs-stellar-xdr",
          "vendor": "stellar",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 25.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "stellar-xdr is a library and CLI containing types and functionality for working with Stellar XDR. Prior to version 25.0.1, StringM::from_str does not validate that the input length is within the declared maximum (MAX). Calling StringM::\u003cN\u003e::from_str(s) where s is longer than N bytes succeeds and returns an Ok value instead of Err(Error::LengthExceedsMax), producing a StringM that violates its length invariant. This affects any code that constructs StringM values from string input using FromStr (including str::parse), and relies on the type\u0027s maximum length constraint being enforced. An oversized StringM could propagate through serialization, validation, or other logic that assumes the invariant holds. This issue has been patched in version 25.0.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-06T20:42:43.403Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/stellar/rs-stellar-xdr/security/advisories/GHSA-x57h-xx53-v53w",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/stellar/rs-stellar-xdr/security/advisories/GHSA-x57h-xx53-v53w"
        },
        {
          "name": "https://github.com/stellar/rs-stellar-xdr/issues/499",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/stellar/rs-stellar-xdr/issues/499"
        },
        {
          "name": "https://github.com/stellar/rs-stellar-xdr/pull/500",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/stellar/rs-stellar-xdr/pull/500"
        },
        {
          "name": "https://github.com/stellar/rs-stellar-xdr/commit/1f840013c3e2fca0321fb844b048afa01d10dda6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/stellar/rs-stellar-xdr/commit/1f840013c3e2fca0321fb844b048afa01d10dda6"
        }
      ],
      "source": {
        "advisory": "GHSA-x57h-xx53-v53w",
        "discovery": "UNKNOWN"
      },
      "title": "stellar-xdr: `StringM::from_str` bypasses max length validation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-29795",
    "datePublished": "2026-03-06T20:42:43.403Z",
    "dateReserved": "2026-03-04T16:26:02.900Z",
    "dateUpdated": "2026-03-09T20:54:30.156Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-29795\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-03-06T21:16:15.950\",\"lastModified\":\"2026-03-09T13:35:34.633\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"stellar-xdr is a library and CLI containing types and functionality for working with Stellar XDR. Prior to version 25.0.1, StringM::from_str does not validate that the input length is within the declared maximum (MAX). Calling StringM::\u003cN\u003e::from_str(s) where s is longer than N bytes succeeds and returns an Ok value instead of Err(Error::LengthExceedsMax), producing a StringM that violates its length invariant. This affects any code that constructs StringM values from string input using FromStr (including str::parse), and relies on the type\u0027s maximum length constraint being enforced. An oversized StringM could propagate through serialization, validation, or other logic that assumes the invariant holds. This issue has been patched in version 25.0.1.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N\",\"baseScore\":4.0,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.5,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-770\"}]}],\"references\":[{\"url\":\"https://github.com/stellar/rs-stellar-xdr/commit/1f840013c3e2fca0321fb844b048afa01d10dda6\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/stellar/rs-stellar-xdr/issues/499\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/stellar/rs-stellar-xdr/pull/500\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/stellar/rs-stellar-xdr/security/advisories/GHSA-x57h-xx53-v53w\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-29795\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-09T20:49:57.353796Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-09T20:51:40.327Z\"}}], \"cna\": {\"title\": \"stellar-xdr: `StringM::from_str` bypasses max length validation\", \"source\": {\"advisory\": \"GHSA-x57h-xx53-v53w\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"stellar\", \"product\": \"rs-stellar-xdr\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 25.0.1\"}]}], \"references\": [{\"url\": \"https://github.com/stellar/rs-stellar-xdr/security/advisories/GHSA-x57h-xx53-v53w\", \"name\": \"https://github.com/stellar/rs-stellar-xdr/security/advisories/GHSA-x57h-xx53-v53w\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/stellar/rs-stellar-xdr/issues/499\", \"name\": \"https://github.com/stellar/rs-stellar-xdr/issues/499\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/stellar/rs-stellar-xdr/pull/500\", \"name\": \"https://github.com/stellar/rs-stellar-xdr/pull/500\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/stellar/rs-stellar-xdr/commit/1f840013c3e2fca0321fb844b048afa01d10dda6\", \"name\": \"https://github.com/stellar/rs-stellar-xdr/commit/1f840013c3e2fca0321fb844b048afa01d10dda6\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"stellar-xdr is a library and CLI containing types and functionality for working with Stellar XDR. Prior to version 25.0.1, StringM::from_str does not validate that the input length is within the declared maximum (MAX). Calling StringM::\u003cN\u003e::from_str(s) where s is longer than N bytes succeeds and returns an Ok value instead of Err(Error::LengthExceedsMax), producing a StringM that violates its length invariant. This affects any code that constructs StringM values from string input using FromStr (including str::parse), and relies on the type\u0027s maximum length constraint being enforced. An oversized StringM could propagate through serialization, validation, or other logic that assumes the invariant holds. This issue has been patched in version 25.0.1.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-770\", \"description\": \"CWE-770: Allocation of Resources Without Limits or Throttling\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-03-06T20:42:43.403Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-29795\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-03-09T20:54:30.156Z\", \"dateReserved\": \"2026-03-04T16:26:02.900Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-03-06T20:42:43.403Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-X57H-XX53-V53W

Vulnerability from github – Published: 2026-03-05 20:45 – Updated: 2026-03-06 22:51

Summary

stellar-xdr's StringM::from_str bypasses max length validation

Details

Impact

StringM::from_str does not validate that the input length is within the declared maximum (MAX). Calling StringM::<N>::from_str(s) where s is longer than N bytes succeeds and returns an Ok value instead of Err(Error::LengthExceedsMax), producing a StringM that violates its length invariant.

This affects any code that constructs StringM values from string input using FromStr (including str::parse), and relies on the type's maximum length constraint being enforced. An oversized StringM could propagate through serialization, validation, or other logic that assumes the invariant holds.

All published versions of the stellar-xdr crate up to and including v25.0.0 are affected.

Patches

The fix is merged in #500. It replaces the direct Ok(Self(b)) construction with b.try_into(), which routes through TryFrom<Vec<u8>> and properly validates the length — matching the pattern already used by BytesM::from_str.

Users should upgrade to the first release containing this fix once published (the next release after v25.0.0).

Workarounds

Validate the byte length of string input before calling StringM::from_str, or construct StringM values via StringM::try_from(s.as_bytes().to_vec()) which correctly enforces the length constraint.

References

Issue: https://github.com/stellar/rs-stellar-xdr/issues/499
Fix: https://github.com/stellar/rs-stellar-xdr/pull/500

Severity ?

4.0 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 25.0.0"
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "stellar-xdr"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "25.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-29795"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-05T20:45:46Z",
    "nvd_published_at": "2026-03-06T21:16:15Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\n`StringM::from_str` does not validate that the input length is within the declared maximum (`MAX`). Calling `StringM::\u003cN\u003e::from_str(s)` where `s` is longer than `N` bytes succeeds and returns an `Ok` value instead of `Err(Error::LengthExceedsMax)`, producing a `StringM` that violates its length invariant.\n\nThis affects any code that constructs `StringM` values from string input using `FromStr` (including `str::parse`), and relies on the type\u0027s maximum length constraint being enforced. An oversized `StringM` could propagate through serialization, validation, or other logic that assumes the invariant holds.\n\nAll published versions of the `stellar-xdr` crate up to and including `v25.0.0` are affected.\n\n### Patches\n\nThe fix is merged in [#500](https://github.com/stellar/rs-stellar-xdr/pull/500). It replaces the direct `Ok(Self(b))` construction with `b.try_into()`, which routes through `TryFrom\u003cVec\u003cu8\u003e\u003e` and properly validates the length \u2014 matching the pattern already used by `BytesM::from_str`.\n\nUsers should upgrade to the first release containing this fix once published (the next release after `v25.0.0`).\n\n### Workarounds\n\nValidate the byte length of string input before calling `StringM::from_str`, or construct `StringM` values via `StringM::try_from(s.as_bytes().to_vec())` which correctly enforces the length constraint.\n\n### References\n\n- Issue: https://github.com/stellar/rs-stellar-xdr/issues/499\n- Fix: https://github.com/stellar/rs-stellar-xdr/pull/500",
  "id": "GHSA-x57h-xx53-v53w",
  "modified": "2026-03-06T22:51:52Z",
  "published": "2026-03-05T20:45:46Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/stellar/rs-stellar-xdr/security/advisories/GHSA-x57h-xx53-v53w"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29795"
    },
    {
      "type": "WEB",
      "url": "https://github.com/stellar/rs-stellar-xdr/issues/499"
    },
    {
      "type": "WEB",
      "url": "https://github.com/stellar/rs-stellar-xdr/pull/500"
    },
    {
      "type": "WEB",
      "url": "https://github.com/stellar/rs-stellar-xdr/commit/1f840013c3e2fca0321fb844b048afa01d10dda6"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/stellar/rs-stellar-xdr"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "stellar-xdr\u0027s StringM::from_str bypasses max length validation"
}

FKIE_CVE-2026-29795

Vulnerability from fkie_nvd - Published: 2026-03-06 21:16 - Updated: 2026-03-09 13:35

Severity ?

4.0 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/stellar/rs-stellar-xdr/commit/1f840013c3e2fca0321fb844b048afa01d10dda6
	security-advisories@github.com	https://github.com/stellar/rs-stellar-xdr/issues/499
	security-advisories@github.com	https://github.com/stellar/rs-stellar-xdr/pull/500
	security-advisories@github.com	https://github.com/stellar/rs-stellar-xdr/security/advisories/GHSA-x57h-xx53-v53w

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "stellar-xdr is a library and CLI containing types and functionality for working with Stellar XDR. Prior to version 25.0.1, StringM::from_str does not validate that the input length is within the declared maximum (MAX). Calling StringM::\u003cN\u003e::from_str(s) where s is longer than N bytes succeeds and returns an Ok value instead of Err(Error::LengthExceedsMax), producing a StringM that violates its length invariant. This affects any code that constructs StringM values from string input using FromStr (including str::parse), and relies on the type\u0027s maximum length constraint being enforced. An oversized StringM could propagate through serialization, validation, or other logic that assumes the invariant holds. This issue has been patched in version 25.0.1."
    },
    {
      "lang": "es",
      "value": "stellar-xdr es una librer\u00eda y CLI que contiene tipos y funcionalidades para trabajar con Stellar XDR. Antes de la versi\u00f3n 25.0.1, StringM::from_str no valida que la longitud de entrada est\u00e9 dentro del m\u00e1ximo declarado (MAX). Llamar a StringM::::from_str(s) donde s es m\u00e1s largo que N bytes tiene \u00e9xito y devuelve un valor Ok en lugar de Err(Error::LengthExceedsMax), produciendo un StringM que viola su invariante de longitud. Esto afecta a cualquier c\u00f3digo que construye valores StringM a partir de una entrada de cadena usando FromStr (incluyendo str::parse), y que depende de que se aplique la restricci\u00f3n de longitud m\u00e1xima del tipo. Un StringM sobredimensionado podr\u00eda propagarse a trav\u00e9s de la serializaci\u00f3n, la validaci\u00f3n u otra l\u00f3gica que asume que el invariante se mantiene. Este problema ha sido parcheado en la versi\u00f3n 25.0.1."
    }
  ],
  "id": "CVE-2026-29795",
  "lastModified": "2026-03-09T13:35:34.633",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 4.0,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-03-06T21:16:15.950",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/stellar/rs-stellar-xdr/commit/1f840013c3e2fca0321fb844b048afa01d10dda6"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/stellar/rs-stellar-xdr/issues/499"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/stellar/rs-stellar-xdr/pull/500"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/stellar/rs-stellar-xdr/security/advisories/GHSA-x57h-xx53-v53w"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Undergoing Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-29795 (GCVE-0-2026-29795)

GHSA-X57H-XX53-V53W

Impact

Patches

Workarounds

References

FKIE_CVE-2026-29795

Tags

Sightings

Nomenclature