Vulnerability in Soroban SDK Affects Scalar Field Type Comparisons

CVE-2026-32322

What is CVE-2026-32322?

The Soroban SDK, utilized for developing Soroban contracts, contains a flaw in the comparison of Fr (scalar field) types for BN254 and BLS12-381. Prior to specific versions, the SDK compared field values using their raw U256 representation without first reducing them modulo the field modulus r. This improper handling can cause mathematically equivalent field elements to appear unequal. Attackers can exploit this by supplying crafted Fr values through contract inputs, leading to possible errors in smart contract operations. Such mistakes may result in incorrect authorization decisions or validation bypasses, particularly in contracts with security-critical logic that rely on Fr equality checks. The issue is resolved in versions 22.0.11, 23.5.3, and 25.3.0.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References