https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T10:24:28.911285+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-162298 EUVD-2026-162298 2026-10-05T10:24:28.914024+00:00 EUVD-2026-162298 https://cve.radiocsirt.org/vuln/fkie_cve-2023-46135 fkie_cve-2023-46135 2026-10-05T10:24:28.914057+00:00

rs-stellar-strkey is a Rust lib for encode/decode of Stellar Strkeys. A panic vulnerability occurs when a specially crafted payload is used.`inner_payload_len` should not above 64. This vulnerability has been patched in version 0.0.8.

 https://cve.radiocsirt.org/vuln/ghsa-5873-6fwq-463f GHSA-5873-6fwq-463f — stellar-strkey vulnerable to panic in SignedPayload::from_payload 2026-10-05T10:24:28.914087+00:00

Affected: crates.io: stellar-strkey

### Impact Panic vulnerability when a specially crafted payload is used. This is because of the following calculation: ```rust inner_payload_len + (4 - inner_payload_len % 4) % 4 ``` If `inner_payload_len` is `0xffffffff`, `(4 - inner_payload_len % 4) % 4 = 1` so ```rust inner_payload_len + (4 - inner_payload_len % 4) % 4 = u32::MAX + 1 ``` which overflow.

### Patches Check that `inner_payload_len` is not above 64 which should never be the case. Patched in version 0.0.8

### Workarounds Sanitize input payload before it is passed to the vulnerable function so that bytes in `payload[32..32+4]` and parsed as a `u32` is not above 64.

### References GitHub issue #58

 https://cve.radiocsirt.org/vuln/gsd-2023-46135 gsd-2023-46135 2026-10-05T10:24:28.914117+00:00 gsd-2023-46135