https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-32322.htmlhttps://patchthecve.com/cve/CVE-2026-32322.htmlWed, 17 Jun 2026 10:35:33 +0000MEDIUM 5.3: soroban-sdk is a Rust SDK for Soroban contracts. Prior to 22.0.11, 23.5.3, and 25.3.0, The Fr (scalar field) types for BN254 and BLS12-381 in soroban-sdk compared values using their raw U256 representation without first reducing modulo the field modulus r. This caused mathematically equal field elemhttps://patchthecve.com/cve/CVE-2026-29795.htmlhttps://patchthecve.com/cve/CVE-2026-29795.htmlWed, 17 Jun 2026 10:29:54 +0000MEDIUM 4.0: stellar-xdr is a library and CLI containing types and functionality for working with Stellar XDR. Prior to version 25.0.1, StringM::from_str does not validate that the input length is within the declared maximum (MAX). Calling StringM::<N>::from_str(s) where s is longer than N bytes succeeds and rethttps://patchthecve.com/cve/CVE-2026-24889.htmlhttps://patchthecve.com/cve/CVE-2026-24889.htmlWed, 17 Jun 2026 10:23:45 +0000MEDIUM 5.3: soroban-sdk is a Rust SDK for Soroban contracts. Arithmetic overflow can be triggered in the `Bytes::slice`, `Vec::slice`, and `Prng::gen_range` (for `u64`) methods in the `soroban-sdk` in versions up to and including `25.0.1`, `23.5.1`, and `25.0.2`. Contracts that pass user-controlled or computed