Advisory Database
  • Advisories
  • Dependency Scanning
  1. cargo
  2. ›
  3. soroban-env-host
  4. ›
  5. GHSA-pm4j-7r4q-ccg8

GHSA-pm4j-7r4q-ccg8: Soroban: Muxed address<->ScVal conversions may break after a conversion failure

March 7, 2026

Soroban host ensures that MuxedAddress objects can’t be used as storage keys in order to proactively prevent the contract logic bugs. However, due to a bug in Soroban host implementation, a failure in Val->ScVal conversion during the storage key computation will have the flag indicating that storage conversion is happening stuck in the true state until the next storage access. While the flag is stuck in true state, any MuxedAddress object conversions to ScVal will fail, i.e. a failure will occur if a MuxedAddress is emitted in the event or is serialized to XDR via a host function.

References

  • github.com/advisories/GHSA-pm4j-7r4q-ccg8
  • github.com/stellar/rs-soroban-env
  • github.com/stellar/rs-soroban-env/security/advisories/GHSA-pm4j-7r4q-ccg8

Code Behaviors & Features

Detect and mitigate GHSA-pm4j-7r4q-ccg8 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 26.0.0

Fixed versions

  • 26.0.0

Solution

Upgrade to version 26.0.0 or above.

Impact 5.3 MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Learn more about CVSS

Weakness

  • CWE-681: Incorrect Conversion between Numeric Types

Source file

cargo/soroban-env-host/GHSA-pm4j-7r4q-ccg8.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Mon, 09 Mar 2026 00:17:53 +0000.