{"id":"CVE-2026-29795","aliases":["GHSA-x57h-xx53-v53w"],"url":"https://o3.security/vulnerability/CVE-2026-29795","summary":"stellar-xdr: `StringM::from_str` bypasses max length validation","details":"### Impact\n\n`StringM::from_str` does not validate that the input length is within the declared maximum (`MAX`). Calling `StringM::<N>::from_str(s)` where `s` is longer than `N` bytes succeeds and returns an `Ok` value instead of `Err(Error::LengthExceedsMax)`, producing a `StringM` that violates its length invariant.\n\nThis affects any code that constructs `StringM` values from string input using `FromStr` (including `str::parse`), and relies on the type's maximum length constraint being enforced. An oversized `StringM` could propagate through serialization, validation, or other logic that assumes the invariant holds.\n\nAll published versions of the `stellar-xdr` crate up to and including `v25.0.0` are affected.\n\n### Patches\n\nThe fix is merged in [#500](https://github.com/stellar/rs-stellar-xdr/pull/500). It replaces the direct `Ok(Self(b))` construction with `b.try_into()`, which routes through `TryFrom<Vec<u8>>` and properly validates the length — matching the pattern already used by `BytesM::from_str`.\n\nUsers should upgrade to the first release containing this fix once published (the next release after `v25.0.0`).\n\n### Workarounds\n\nValidate the byte length of string input before calling `StringM::from_str`, or construct `StringM` values via `StringM::try_from(s.as_bytes().to_vec())` which correctly enforces the length constraint.\n\n### References\n\n- Issue: https://github.com/stellar/rs-stellar-xdr/issues/499\n- Fix: https://github.com/stellar/rs-stellar-xdr/pull/500","published":"2026-03-06T20:42:43.403Z","modified":"2026-08-12T03:51:27.003600160Z","cvss":{"score":4,"severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"stellar-xdr","fixedVersion":"25.0.1"}],"fix":{"url":"https://github.com/stellar/rs-stellar-xdr/commit/1f840013c3e2fca0321fb844b048afa01d10dda6","label":"stellar/rs-stellar-xdr@1f84001"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29795.json"},{"type":"ADVISORY","url":"https://github.com/stellar/rs-stellar-xdr/security/advisories/GHSA-x57h-xx53-v53w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29795"},{"type":"REPORT","url":"https://github.com/stellar/rs-stellar-xdr/issues/499"},{"type":"FIX","url":"https://github.com/stellar/rs-stellar-xdr/commit/1f840013c3e2fca0321fb844b048afa01d10dda6"},{"type":"FIX","url":"https://github.com/stellar/rs-stellar-xdr/pull/500"},{"type":"PACKAGE","url":"https://github.com/stellar/rs-stellar-xdr"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:27.003600160Z"}}