5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-32322

CVE-2026-32322: soroban-sdk: `Fr` scalar field equality comparison bypasses modular reduction

soroban-sdk is a Rust SDK for Soroban contracts. Prior to 22.0.11, 23.5.3, and 25.3.0, The Fr (scalar field) types for BN254 and BLS12-381 in soroban-sdk compared values using their raw U256 representation without first reducing modulo the field modulus r. This caused mathematically equal field elements to compare as not-equal when one or both values were unreduced (i.e., >= r). The vulnerability requires an attacker to supply crafted Fr values through contract inputs, and compare them directly without going through host-side arithmetic operations. Smart contracts that rely on Fr equality checks for security-critical logic could produce incorrect results. The impact depends on how the affected contract uses Fr equality comparisons, but can result in incorrect authorization decisions or validation bypasses in contracts that perform equality checks on user-supplied scalar values. This vulnerability is fixed in 22.0.11, 23.5.3, and 25.3.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-32322

CVE-2026-32322:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
soroban-sdk	rust	>= 25.0.0, < 25.3.0	25.3.0
soroban-sdk	rust	>= 23.0.0, < 23.5.3	23.5.3
soroban-sdk	rust	< 22.0.11	22.0.11

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The core of the vulnerability lies in the construction of Fr (scalar field) types for both BN254 and BLS12-381 curves in the soroban-sdk. The Fr type is a wrapper around a U256 integer. The PartialEq trait, which is used for equality checks (==), was derived, meaning it performed a direct bit-for-bit comparison of the underlying U256 values.

The vulnerability arises because the constructors for Fr, such as from_u256, from_bytes, and the From<U256> trait implementation, accepted any U256 value without reducing it modulo the scalar field's modulus, r. In modular arithmetic, x and x + r are considered equal. However, because the raw U256 representations were stored, an Fr object representing 1 and another representing r + 1 would not be considered equal by the PartialEq implementation.

An attacker could exploit this by supplying a specially crafted, unreduced Fr value as input to a smart contract. If the contract's logic relies on equality checks involving this Fr value (e.g., for authorization), the check could produce an incorrect result, potentially leading to a bypass of security controls.

The patch addresses this by modifying the Fr constructors, specifically the From<U256> for Fr implementation, to always perform a modular reduction on the input value. This ensures that all Fr objects store their value in a canonical form (i.e., within the range [0, r)), guaranteeing that mathematically equal field elements will have identical internal representations and thus compare as equal.

Additionally, a related input validation vulnerability was fixed for the Fp and Fp2 base field types, which now validate that their values are strictly less than the field modulus upon construction.

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.