4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-29795

CVE-2026-29795: stellar-xdr: `StringM::from_str` bypasses max length validation

stellar-xdr is a library and CLI containing types and functionality for working with Stellar XDR. Prior to version 25.0.1, StringM::from_str does not validate that the input length is within the declared maximum (MAX). Calling StringM::<N>::from_str(s) where s is longer than N bytes succeeds and returns an Ok value instead of Err(Error::LengthExceedsMax), producing a StringM that violates its length invariant. This affects any code that constructs StringM values from string input using FromStr (including str::parse), and relies on the type's maximum length constraint being enforced. An oversized StringM could propagate through serialization, validation, or other logic that assumes the invariant holds. This issue has been patched in version 25.0.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-29795

CVE-2026-29795:

4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
stellar-xdr	rust	<= 25.0.0	25.0.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the stellar-xdr Rust crate, specifically within the implementation of the FromStr trait for the StringM<MAX> type. The function StringM::from_str was implemented to convert a string slice (&str) into a StringM object. However, it failed to validate whether the length of the input string exceeded the maximum length (MAX) defined for the StringM instance. The patch replaces the direct and unsafe construction Ok(Self(b)) with b.try_into(). This change routes the construction through the TryFrom<Vec<u8>> implementation for StringM, which already contains the necessary length validation logic. An attacker could exploit this by supplying a string longer than the allowed maximum, causing the creation of an oversized StringM object. This could lead to unexpected behavior, potential buffer overflows, or other security issues in downstream code that relies on the StringM's length invariant.

Vulnerable functions

StringM::from_str

src/curr/generated.rs

The `from_str` function for `StringM` did not validate if the input string's length exceeded the generic constant `MAX`. It directly constructed a `StringM` instance with a byte vector that could be larger than the specified maximum by calling `Ok(Self(b))`. This violates the type's invariant. The fix replaces this with `b.try_into()`, which correctly performs the length validation.

StringM::from_str

src/next/generated.rs

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.