CVE-2023-46135 - CVE House
Back to Database
Status published Medium CVE-2023-46135

Panic in SignedPayload::from_payload

Vulnerability Description

rs-stellar-strkey is a Rust lib for encode/decode of Stellar Strkeys. A panic vulnerability occurs when a specially crafted payload is used.`inner_payload_len` should not above 64. This vulnerability has been patched in version 0.0.8.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-46135

Credits & Attribution

No credits recorded in the NVD database.

References

More from stellar

View All →
CVE-2024-32985
Stellar-core's Overlay - security fix for DDoS mitigation
Medium 5.9
CVE-2023-40580
Freighter mnemonic phrase may be accessed by Javascript through a private API
High 8.1
CVE-2021-32738
Utils.readChallengeTx does not verify the server account signature
Medium 6.5

Affected Vendor

Affected Software

rs-stellar-strkey
Vulnerable Versions:
< 0.0.8

Timeline

Official Publish: October 25th, 2023
Last Modified: September 10th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weaknesses (CWE)

CWE-248

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1203 Exploitation for Client Execution
Execution
T1213 Data from Information Repositories
Collection
T1499.003 Application Exhaustion Flood
Impact