Moderate severityOSV Advisory· Published Jan 28, 2026· Updated Jan 29, 2026

soroban-sdk has overflow in Bytes::slice, Vec::slice, GenRange::gen_range for u64

CVE-2026-24889

Description

soroban-sdk is a Rust SDK for Soroban contracts. Arithmetic overflow can be triggered in the Bytes::slice, Vec::slice, and Prng::gen_range (for u64) methods in the soroban-sdk in versions up to and including 25.0.1, 23.5.1, and 25.0.2. Contracts that pass user-controlled or computed range bounds to Bytes::slice, Vec::slice, or Prng::gen_range may silently operate on incorrect data ranges or generate random numbers from an unintended range, potentially resulting in corrupted contract state. Note that the best practice when using the soroban-sdk and building Soroban contracts is to always enable overflow-checks = true. The stellar contract init tool that prepares the boiler plate for a Soroban contract, as well as all examples and docs, encourage the use of configuring overflow-checks = true on release profiles so that these arithmetic operations fail rather than silently wrap. Contracts are only impacted if they use overflow-checks = false either explicitly or implicitly. It is anticipated the majority of contracts could not be impacted because the best practice encouraged by tooling is to enable overflow-checks. The fix available in 25.0.1, 23.5.1, and 25.0.2 replaces bare arithmetic with checked_add / checked_sub, ensuring overflow traps regardless of the overflow-checks profile setting. As a workaround, contract workspaces can be configured with a profile available in the GitHub Securtity Advisory to enable overflow checks on the arithmetic operations. This is the best practice when developing Soroban contracts, and the default if using the contract boilerplate generated using stellar contract init. Alternatively, contracts can validate range bounds before passing them to slice or gen_range to ensure the conversions cannot overflow.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
soroban-sdkcrates.io	>= 25.0.0, < 25.0.2	25.0.2
soroban-sdkcrates.io	>= 23.0.0, < 23.5.1	23.5.1
soroban-sdkcrates.io	< 22.0.9	22.0.9

Affected products

Stellar/Rs Soroban SdkOSV
Range: v0.0.3, v0.0.4, v0.0.6, …

Patches

c2757c6d774d

Fix range bound overflow in Vec/Bytes slice and GenRange gen_range for u64 (#1703)

https://github.com/stellar/rs-soroban-sdkLeighJan 28, 2026via ghsa

commit

8 files changed · +321 −6

soroban-sdk/src/bytes.rs+6 −2 modified

@@ -739,11 +739,15 @@ impl Bytes {
     pub fn slice(&self, r: impl RangeBounds<u32>) -> Self {
         let start_bound = match r.start_bound() {
             Bound::Included(s) => *s,
-            Bound::Excluded(s) => *s + 1,
+            Bound::Excluded(s) => s
+                .checked_add(1)
+                .expect_optimized("attempt to add with overflow"),
             Bound::Unbounded => 0,
         };
         let end_bound = match r.end_bound() {
-            Bound::Included(s) => *s + 1,
+            Bound::Included(s) => s
+                .checked_add(1)
+                .expect_optimized("attempt to add with overflow"),
             Bound::Excluded(s) => *s,
             Bound::Unbounded => self.len(),
         };

soroban-sdk/src/prng.rs+6 −2 modified

@@ -469,12 +469,16 @@ impl GenRange for u64 {
         assert_in_contract!(env);
         let start_bound = match r.start_bound() {
             Bound::Included(b) => *b,
-            Bound::Excluded(b) => *b + 1,
+            Bound::Excluded(b) => b
+                .checked_add(1)
+                .expect_optimized("attempt to add with overflow"),
             Bound::Unbounded => u64::MIN,
         };
         let end_bound = match r.end_bound() {
             Bound::Included(b) => *b,
-            Bound::Excluded(b) => *b - 1,
+            Bound::Excluded(b) => b
+                .checked_sub(1)
+                .expect_optimized("attempt to subtract with overflow"),
             Bound::Unbounded => u64::MAX,
         };
         internal::Env::prng_u64_in_inclusive_range(env, start_bound, end_bound).unwrap_infallible()

soroban-sdk/src/tests/bytes_slice.rs+83 −0 added

@@ -0,0 +1,83 @@
+use core::ops::Bound;
+
+use crate::{Bytes, Env};
+
+#[test]
+fn test_slice_full_range() {
+    let env = Env::default();
+    let bytes = Bytes::from_slice(&env, &[1, 2, 3]);
+    let sliced = bytes.slice(0..3);
+    assert_eq!(sliced.len(), 3);
+    assert_eq!(sliced.get_unchecked(0), 1);
+    assert_eq!(sliced.get_unchecked(1), 2);
+    assert_eq!(sliced.get_unchecked(2), 3);
+}
+
+#[test]
+fn test_slice_middle() {
+    let env = Env::default();
+    let bytes = Bytes::from_slice(&env, &[1, 2, 3]);
+    let sliced = bytes.slice(1..2);
+    assert_eq!(sliced.len(), 1);
+    assert_eq!(sliced.get_unchecked(0), 2);
+}
+
+// Excluded(u32::MAX) start computes u32::MAX + 1 which overflows.
+#[test]
+#[should_panic(expected = "attempt to add with overflow")]
+fn test_slice_excluded_start_u32_max_overflows_panics_guest_side() {
+    let env = Env::default();
+    let bytes = Bytes::from_slice(&env, &[1, 2, 3]);
+    let _ = bytes.slice((Bound::Excluded(u32::MAX), Bound::Unbounded));
+}
+
+// Included(u32::MAX) end computes u32::MAX + 1 which overflows.
+#[test]
+#[should_panic(expected = "attempt to add with overflow")]
+fn test_slice_included_end_u32_max_overflows_panics_guest_side() {
+    let env = Env::default();
+    let bytes = Bytes::from_slice(&env, &[1, 2, 3]);
+    let _ = bytes.slice(0..=u32::MAX);
+}
+
+// Both bounds u32::MAX: Excluded start computes u32::MAX + 1 which overflows,
+// and Included end computes u32::MAX + 1 which also overflows.
+#[test]
+#[should_panic(expected = "attempt to add with overflow")]
+fn test_slice_both_u32_max_overflows_panics_guest_side() {
+    let env = Env::default();
+    let bytes = Bytes::from_slice(&env, &[1, 2, 3]);
+    let _ = bytes.slice(u32::MAX..=u32::MAX);
+}
+
+#[test]
+#[should_panic(expected = "HostError: Error(Object, IndexBounds)")]
+fn test_slice_out_of_bounds_end_host_side() {
+    let env = Env::default();
+    let bytes = Bytes::from_slice(&env, &[1, 2, 3]);
+    let _ = bytes.slice(0..4);
+}
+
+#[test]
+#[should_panic(expected = "HostError: Error(Object, IndexBounds)")]
+fn test_slice_out_of_bounds_start_host_side() {
+    let env = Env::default();
+    let bytes = Bytes::from_slice(&env, &[1, 2, 3]);
+    let _ = bytes.slice(4..);
+}
+
+#[test]
+fn test_slice_empty_full_range() {
+    let env = Env::default();
+    let bytes = Bytes::new(&env);
+    let sliced = bytes.slice(..);
+    assert_eq!(sliced.len(), 0);
+}
+
+#[test]
+fn test_slice_empty_zero_range() {
+    let env = Env::default();
+    let bytes = Bytes::new(&env);
+    let sliced = bytes.slice(0..0);
+    assert_eq!(sliced.len(), 0);
+}

soroban-sdk/src/tests/prng_range.rs+111 −0 added

@@ -0,0 +1,111 @@
+use core::ops::Bound;
+
+use crate::{self as soroban_sdk, testutils::EnvTestConfig, Env};
+use soroban_sdk::contract;
+
+#[contract]
+pub struct TestPrngRangeContract;
+
+#[test]
+fn test_gen_range_u64_full_range() {
+    let env = Env::new_with_config(EnvTestConfig {
+        capture_snapshot_at_drop: false,
+    });
+    let id = env.register(TestPrngRangeContract, ());
+    env.as_contract(&id, || {
+        let _: u64 = env.prng().gen_range(..);
+    });
+}
+
+#[test]
+fn test_gen_range_u64_inclusive() {
+    let env = Env::new_with_config(EnvTestConfig {
+        capture_snapshot_at_drop: false,
+    });
+    let id = env.register(TestPrngRangeContract, ());
+    env.as_contract(&id, || {
+        for _ in 0..100 {
+            let val: u64 = env.prng().gen_range(5..=10);
+            assert!(val >= 5 && val <= 10);
+        }
+    });
+}
+
+#[test]
+fn test_gen_range_u64_exclusive_end() {
+    let env = Env::new_with_config(EnvTestConfig {
+        capture_snapshot_at_drop: false,
+    });
+    let id = env.register(TestPrngRangeContract, ());
+    env.as_contract(&id, || {
+        for _ in 0..100 {
+            let val: u64 = env.prng().gen_range(5..10);
+            assert!(val >= 5 && val < 10);
+        }
+    });
+}
+
+#[test]
+fn test_gen_range_u64_single_value() {
+    let env = Env::new_with_config(EnvTestConfig {
+        capture_snapshot_at_drop: false,
+    });
+    let id = env.register(TestPrngRangeContract, ());
+    env.as_contract(&id, || {
+        let val: u64 = env.prng().gen_range(7..=7);
+        assert_eq!(val, 7);
+    });
+}
+
+// Excluded(u64::MAX) start computes u64::MAX + 1 which overflows.
+#[test]
+#[should_panic(expected = "attempt to add with overflow")]
+fn test_gen_range_u64_excluded_start_u64_max_overflows() {
+    let env = Env::new_with_config(EnvTestConfig {
+        capture_snapshot_at_drop: false,
+    });
+    let id = env.register(TestPrngRangeContract, ());
+    env.as_contract(&id, || {
+        let _: u64 = env
+            .prng()
+            .gen_range((Bound::Excluded(u64::MAX), Bound::Unbounded));
+    });
+}
+
+#[test]
+fn test_gen_range_u64_included_end_u64_max() {
+    let env = Env::new_with_config(EnvTestConfig {
+        capture_snapshot_at_drop: false,
+    });
+    let id = env.register(TestPrngRangeContract, ());
+    env.as_contract(&id, || {
+        let _: u64 = env.prng().gen_range(0u64..=u64::MAX);
+    });
+}
+
+// Excluded(0) end computes 0 - 1 which underflows.
+#[should_panic(expected = "attempt to subtract with overflow")]
+#[test]
+fn test_gen_range_u64_excluded_end_zero_underflows() {
+    let env = Env::new_with_config(EnvTestConfig {
+        capture_snapshot_at_drop: false,
+    });
+    let id = env.register(TestPrngRangeContract, ());
+    env.as_contract(&id, || {
+        let _: u64 = env
+            .prng()
+            .gen_range((Bound::<u64>::Unbounded, Bound::Excluded(0)));
+    });
+}
+
+#[test]
+fn test_gen_range_u64_both_u64_max() {
+    let env = Env::new_with_config(EnvTestConfig {
+        capture_snapshot_at_drop: false,
+    });
+    let id = env.register(TestPrngRangeContract, ());
+    env.as_contract(&id, || {
+        let val: u64 = env.prng().gen_range(u64::MAX..=u64::MAX);
+        assert_eq!(val, u64::MAX);
+    });
+}

soroban-sdk/src/tests.rs+3 −0 modified

@@ -5,6 +5,7 @@ mod address_payload;
 mod auth;
 mod bytes_alloc_vec;
 mod bytes_buffer;
+mod bytes_slice;
 mod cmp_across_env_in_tests;
 mod contract_add_i32;
 mod contract_assert;
@@ -41,7 +42,9 @@ mod env;
 mod max_ttl;
 mod muxed_address;
 mod prng;
+mod prng_range;
 mod proptest_scval_cmp;
 mod proptest_val_cmp;
 mod storage_testutils;
 mod token_client;
+mod vec_slice;

soroban-sdk/src/tests/vec_slice.rs+83 −0 added

@@ -0,0 +1,83 @@
+use core::ops::Bound;
+
+use crate::{vec, Env, Vec};
+
+#[test]
+fn test_slice_full_range() {
+    let env = Env::default();
+    let v: Vec<u32> = vec![&env, 1, 2, 3];
+    let sliced = v.slice(0..3);
+    assert_eq!(sliced.len(), 3);
+    assert_eq!(sliced.get_unchecked(0), 1);
+    assert_eq!(sliced.get_unchecked(1), 2);
+    assert_eq!(sliced.get_unchecked(2), 3);
+}
+
+#[test]
+fn test_slice_middle() {
+    let env = Env::default();
+    let v: Vec<u32> = vec![&env, 1, 2, 3];
+    let sliced = v.slice(1..2);
+    assert_eq!(sliced.len(), 1);
+    assert_eq!(sliced.get_unchecked(0), 2);
+}
+
+// Excluded(u32::MAX) start computes u32::MAX + 1 which overflows.
+#[test]
+#[should_panic(expected = "attempt to add with overflow")]
+fn test_slice_excluded_start_u32_max_overflows_panics_guest_side() {
+    let env = Env::default();
+    let v: Vec<u32> = vec![&env, 1, 2, 3];
+    let _ = v.slice((Bound::Excluded(u32::MAX), Bound::Unbounded));
+}
+
+// Included(u32::MAX) end computes u32::MAX + 1 which overflows.
+#[test]
+#[should_panic(expected = "attempt to add with overflow")]
+fn test_slice_included_end_u32_max_overflows_panics_guest_side() {
+    let env = Env::default();
+    let v: Vec<u32> = vec![&env, 1, 2, 3];
+    let _ = v.slice(0..=u32::MAX);
+}
+
+// Both bounds u32::MAX: Excluded start computes u32::MAX + 1 which overflows,
+// and Included end computes u32::MAX + 1 which also overflows.
+#[test]
+#[should_panic(expected = "attempt to add with overflow")]
+fn test_slice_both_u32_max_overflows_panics_guest_side() {
+    let env = Env::default();
+    let v: Vec<u32> = vec![&env, 1, 2, 3];
+    let _ = v.slice(u32::MAX..=u32::MAX);
+}
+
+#[test]
+#[should_panic(expected = "HostError: Error(Object, IndexBounds)")]
+fn test_slice_out_of_bounds_end_host_side() {
+    let env = Env::default();
+    let v: Vec<u32> = vec![&env, 1, 2, 3];
+    let _ = v.slice(0..4);
+}
+
+#[test]
+#[should_panic(expected = "HostError: Error(Object, IndexBounds)")]
+fn test_slice_out_of_bounds_start_host_side() {
+    let env = Env::default();
+    let v: Vec<u32> = vec![&env, 1, 2, 3];
+    let _ = v.slice(4..);
+}
+
+#[test]
+fn test_slice_empty_full_range() {
+    let env = Env::default();
+    let v: Vec<u32> = vec![&env];
+    let sliced = v.slice(..);
+    assert_eq!(sliced.len(), 0);
+}
+
+#[test]
+fn test_slice_empty_zero_range() {
+    let env = Env::default();
+    let v: Vec<u32> = vec![&env];
+    let sliced = v.slice(0..0);
+    assert_eq!(sliced.len(), 0);
+}

soroban-sdk/src/unwrap.rs+23 −0 modified

@@ -3,6 +3,7 @@ use core::convert::Infallible;
 pub trait UnwrapOptimized {
     type Output;
     fn unwrap_optimized(self) -> Self::Output;
+    fn expect_optimized(self, msg: &'static str) -> Self::Output;
 }
 
 impl<T> UnwrapOptimized for Option<T> {
@@ -18,6 +19,17 @@ impl<T> UnwrapOptimized for Option<T> {
         #[cfg(not(target_family = "wasm"))]
         self.unwrap()
     }
+
+    #[inline(always)]
+    fn expect_optimized(self, _msg: &'static str) -> Self::Output {
+        #[cfg(target_family = "wasm")]
+        match self {
+            Some(t) => t,
+            None => core::arch::wasm32::unreachable(),
+        }
+        #[cfg(not(target_family = "wasm"))]
+        self.expect(_msg)
+    }
 }
 
 impl<T, E: core::fmt::Debug> UnwrapOptimized for Result<T, E> {
@@ -33,6 +45,17 @@ impl<T, E: core::fmt::Debug> UnwrapOptimized for Result<T, E> {
         #[cfg(not(target_family = "wasm"))]
         self.unwrap()
     }
+
+    #[inline(always)]
+    fn expect_optimized(self, _msg: &'static str) -> Self::Output {
+        #[cfg(target_family = "wasm")]
+        match self {
+            Ok(t) => t,
+            Err(_) => core::arch::wasm32::unreachable(),
+        }
+        #[cfg(not(target_family = "wasm"))]
+        self.expect(_msg)
+    }
 }
 
 pub trait UnwrapInfallible {

soroban-sdk/src/vec.rs+6 −2 modified

@@ -783,11 +783,15 @@ impl<T> Vec<T> {
     pub fn slice(&self, r: impl RangeBounds<u32>) -> Self {
         let start_bound = match r.start_bound() {
             Bound::Included(s) => *s,
-            Bound::Excluded(s) => *s + 1,
+            Bound::Excluded(s) => s
+                .checked_add(1)
+                .expect_optimized("attempt to add with overflow"),
             Bound::Unbounded => 0,
         };
         let end_bound = match r.end_bound() {
-            Bound::Included(s) => *s + 1,
+            Bound::Included(s) => s
+                .checked_add(1)
+                .expect_optimized("attempt to add with overflow"),
             Bound::Excluded(s) => *s,
             Bound::Unbounded => self.len(),
         };

3890521426d7

Fix range bound overflow in Vec/Bytes slice and GenRange gen_range for u64 (#1703)

https://github.com/stellar/rs-soroban-sdkLeighJan 28, 2026via ghsa

commit

8 files changed · +321 −6

soroban-sdk/src/bytes.rs+6 −2 modified

@@ -713,11 +713,15 @@ impl Bytes {
     pub fn slice(&self, r: impl RangeBounds<u32>) -> Self {
         let start_bound = match r.start_bound() {
             Bound::Included(s) => *s,
-            Bound::Excluded(s) => *s + 1,
+            Bound::Excluded(s) => s
+                .checked_add(1)
+                .expect_optimized("attempt to add with overflow"),
             Bound::Unbounded => 0,
         };
         let end_bound = match r.end_bound() {
-            Bound::Included(s) => *s + 1,
+            Bound::Included(s) => s
+                .checked_add(1)
+                .expect_optimized("attempt to add with overflow"),
             Bound::Excluded(s) => *s,
             Bound::Unbounded => self.len(),
         };

soroban-sdk/src/prng.rs+6 −2 modified

@@ -469,12 +469,16 @@ impl GenRange for u64 {
         assert_in_contract!(env);
         let start_bound = match r.start_bound() {
             Bound::Included(b) => *b,
-            Bound::Excluded(b) => *b + 1,
+            Bound::Excluded(b) => b
+                .checked_add(1)
+                .expect_optimized("attempt to add with overflow"),
             Bound::Unbounded => u64::MIN,
         };
         let end_bound = match r.end_bound() {
             Bound::Included(b) => *b,
-            Bound::Excluded(b) => *b - 1,
+            Bound::Excluded(b) => b
+                .checked_sub(1)
+                .expect_optimized("attempt to subtract with overflow"),
             Bound::Unbounded => u64::MAX,
         };
         internal::Env::prng_u64_in_inclusive_range(env, start_bound, end_bound).unwrap_infallible()

soroban-sdk/src/tests/bytes_slice.rs+83 −0 added

@@ -0,0 +1,83 @@
+use core::ops::Bound;
+
+use crate::{Bytes, Env};
+
+#[test]
+fn test_slice_full_range() {
+    let env = Env::default();
+    let bytes = Bytes::from_slice(&env, &[1, 2, 3]);
+    let sliced = bytes.slice(0..3);
+    assert_eq!(sliced.len(), 3);
+    assert_eq!(sliced.get_unchecked(0), 1);
+    assert_eq!(sliced.get_unchecked(1), 2);
+    assert_eq!(sliced.get_unchecked(2), 3);
+}
+
+#[test]
+fn test_slice_middle() {
+    let env = Env::default();
+    let bytes = Bytes::from_slice(&env, &[1, 2, 3]);
+    let sliced = bytes.slice(1..2);
+    assert_eq!(sliced.len(), 1);
+    assert_eq!(sliced.get_unchecked(0), 2);
+}
+
+// Excluded(u32::MAX) start computes u32::MAX + 1 which overflows.
+#[test]
+#[should_panic(expected = "attempt to add with overflow")]
+fn test_slice_excluded_start_u32_max_overflows_panics_guest_side() {
+    let env = Env::default();
+    let bytes = Bytes::from_slice(&env, &[1, 2, 3]);
+    let _ = bytes.slice((Bound::Excluded(u32::MAX), Bound::Unbounded));
+}
+
+// Included(u32::MAX) end computes u32::MAX + 1 which overflows.
+#[test]
+#[should_panic(expected = "attempt to add with overflow")]
+fn test_slice_included_end_u32_max_overflows_panics_guest_side() {
+    let env = Env::default();
+    let bytes = Bytes::from_slice(&env, &[1, 2, 3]);
+    let _ = bytes.slice(0..=u32::MAX);
+}
+
+// Both bounds u32::MAX: Excluded start computes u32::MAX + 1 which overflows,
+// and Included end computes u32::MAX + 1 which also overflows.
+#[test]
+#[should_panic(expected = "attempt to add with overflow")]
+fn test_slice_both_u32_max_overflows_panics_guest_side() {
+    let env = Env::default();
+    let bytes = Bytes::from_slice(&env, &[1, 2, 3]);
+    let _ = bytes.slice(u32::MAX..=u32::MAX);
+}
+
+#[test]
+#[should_panic(expected = "HostError: Error(Object, IndexBounds)")]
+fn test_slice_out_of_bounds_end_host_side() {
+    let env = Env::default();
+    let bytes = Bytes::from_slice(&env, &[1, 2, 3]);
+    let _ = bytes.slice(0..4);
+}
+
+#[test]
+#[should_panic(expected = "HostError: Error(Object, IndexBounds)")]
+fn test_slice_out_of_bounds_start_host_side() {
+    let env = Env::default();
+    let bytes = Bytes::from_slice(&env, &[1, 2, 3]);
+    let _ = bytes.slice(4..);
+}
+
+#[test]
+fn test_slice_empty_full_range() {
+    let env = Env::default();
+    let bytes = Bytes::new(&env);
+    let sliced = bytes.slice(..);
+    assert_eq!(sliced.len(), 0);
+}
+
+#[test]
+fn test_slice_empty_zero_range() {
+    let env = Env::default();
+    let bytes = Bytes::new(&env);
+    let sliced = bytes.slice(0..0);
+    assert_eq!(sliced.len(), 0);
+}

soroban-sdk/src/tests/prng_range.rs+111 −0 added

@@ -0,0 +1,111 @@
+use core::ops::Bound;
+
+use crate::{self as soroban_sdk, testutils::EnvTestConfig, Env};
+use soroban_sdk::contract;
+
+#[contract]
+pub struct TestPrngRangeContract;
+
+#[test]
+fn test_gen_range_u64_full_range() {
+    let env = Env::new_with_config(EnvTestConfig {
+        capture_snapshot_at_drop: false,
+    });
+    let id = env.register(TestPrngRangeContract, ());
+    env.as_contract(&id, || {
+        let _: u64 = env.prng().gen_range(..);
+    });
+}
+
+#[test]
+fn test_gen_range_u64_inclusive() {
+    let env = Env::new_with_config(EnvTestConfig {
+        capture_snapshot_at_drop: false,
+    });
+    let id = env.register(TestPrngRangeContract, ());
+    env.as_contract(&id, || {
+        for _ in 0..100 {
+            let val: u64 = env.prng().gen_range(5..=10);
+            assert!(val >= 5 && val <= 10);
+        }
+    });
+}
+
+#[test]
+fn test_gen_range_u64_exclusive_end() {
+    let env = Env::new_with_config(EnvTestConfig {
+        capture_snapshot_at_drop: false,
+    });
+    let id = env.register(TestPrngRangeContract, ());
+    env.as_contract(&id, || {
+        for _ in 0..100 {
+            let val: u64 = env.prng().gen_range(5..10);
+            assert!(val >= 5 && val < 10);
+        }
+    });
+}
+
+#[test]
+fn test_gen_range_u64_single_value() {
+    let env = Env::new_with_config(EnvTestConfig {
+        capture_snapshot_at_drop: false,
+    });
+    let id = env.register(TestPrngRangeContract, ());
+    env.as_contract(&id, || {
+        let val: u64 = env.prng().gen_range(7..=7);
+        assert_eq!(val, 7);
+    });
+}
+
+// Excluded(u64::MAX) start computes u64::MAX + 1 which overflows.
+#[test]
+#[should_panic(expected = "attempt to add with overflow")]
+fn test_gen_range_u64_excluded_start_u64_max_overflows() {
+    let env = Env::new_with_config(EnvTestConfig {
+        capture_snapshot_at_drop: false,
+    });
+    let id = env.register(TestPrngRangeContract, ());
+    env.as_contract(&id, || {
+        let _: u64 = env
+            .prng()
+            .gen_range((Bound::Excluded(u64::MAX), Bound::Unbounded));
+    });
+}
+
+#[test]
+fn test_gen_range_u64_included_end_u64_max() {
+    let env = Env::new_with_config(EnvTestConfig {
+        capture_snapshot_at_drop: false,
+    });
+    let id = env.register(TestPrngRangeContract, ());
+    env.as_contract(&id, || {
+        let _: u64 = env.prng().gen_range(0u64..=u64::MAX);
+    });
+}
+
+// Excluded(0) end computes 0 - 1 which underflows.
+#[should_panic(expected = "attempt to subtract with overflow")]
+#[test]
+fn test_gen_range_u64_excluded_end_zero_underflows() {
+    let env = Env::new_with_config(EnvTestConfig {
+        capture_snapshot_at_drop: false,
+    });
+    let id = env.register(TestPrngRangeContract, ());
+    env.as_contract(&id, || {
+        let _: u64 = env
+            .prng()
+            .gen_range((Bound::<u64>::Unbounded, Bound::Excluded(0)));
+    });
+}
+
+#[test]
+fn test_gen_range_u64_both_u64_max() {
+    let env = Env::new_with_config(EnvTestConfig {
+        capture_snapshot_at_drop: false,
+    });
+    let id = env.register(TestPrngRangeContract, ());
+    env.as_contract(&id, || {
+        let val: u64 = env.prng().gen_range(u64::MAX..=u64::MAX);
+        assert_eq!(val, u64::MAX);
+    });
+}

soroban-sdk/src/tests.rs+3 −0 modified

@@ -4,6 +4,7 @@ mod address;
 mod auth;
 mod bytes_alloc_vec;
 mod bytes_buffer;
+mod bytes_slice;
 mod cmp_across_env_in_tests;
 mod contract_add_i32;
 mod contract_assert;
@@ -35,8 +36,10 @@ mod crypto_sha256;
 mod env;
 mod max_ttl;
 mod prng;
+mod prng_range;
 mod proptest_scval_cmp;
 mod proptest_val_cmp;
 mod storage_testutils;
 mod token_client;
 mod token_spec;
+mod vec_slice;

soroban-sdk/src/tests/vec_slice.rs+83 −0 added

@@ -0,0 +1,83 @@
+use core::ops::Bound;
+
+use crate::{vec, Env, Vec};
+
+#[test]
+fn test_slice_full_range() {
+    let env = Env::default();
+    let v: Vec<u32> = vec![&env, 1, 2, 3];
+    let sliced = v.slice(0..3);
+    assert_eq!(sliced.len(), 3);
+    assert_eq!(sliced.get_unchecked(0), 1);
+    assert_eq!(sliced.get_unchecked(1), 2);
+    assert_eq!(sliced.get_unchecked(2), 3);
+}
+
+#[test]
+fn test_slice_middle() {
+    let env = Env::default();
+    let v: Vec<u32> = vec![&env, 1, 2, 3];
+    let sliced = v.slice(1..2);
+    assert_eq!(sliced.len(), 1);
+    assert_eq!(sliced.get_unchecked(0), 2);
+}
+
+// Excluded(u32::MAX) start computes u32::MAX + 1 which overflows.
+#[test]
+#[should_panic(expected = "attempt to add with overflow")]
+fn test_slice_excluded_start_u32_max_overflows_panics_guest_side() {
+    let env = Env::default();
+    let v: Vec<u32> = vec![&env, 1, 2, 3];
+    let _ = v.slice((Bound::Excluded(u32::MAX), Bound::Unbounded));
+}
+
+// Included(u32::MAX) end computes u32::MAX + 1 which overflows.
+#[test]
+#[should_panic(expected = "attempt to add with overflow")]
+fn test_slice_included_end_u32_max_overflows_panics_guest_side() {
+    let env = Env::default();
+    let v: Vec<u32> = vec![&env, 1, 2, 3];
+    let _ = v.slice(0..=u32::MAX);
+}
+
+// Both bounds u32::MAX: Excluded start computes u32::MAX + 1 which overflows,
+// and Included end computes u32::MAX + 1 which also overflows.
+#[test]
+#[should_panic(expected = "attempt to add with overflow")]
+fn test_slice_both_u32_max_overflows_panics_guest_side() {
+    let env = Env::default();
+    let v: Vec<u32> = vec![&env, 1, 2, 3];
+    let _ = v.slice(u32::MAX..=u32::MAX);
+}
+
+#[test]
+#[should_panic(expected = "HostError: Error(Object, IndexBounds)")]
+fn test_slice_out_of_bounds_end_host_side() {
+    let env = Env::default();
+    let v: Vec<u32> = vec![&env, 1, 2, 3];
+    let _ = v.slice(0..4);
+}
+
+#[test]
+#[should_panic(expected = "HostError: Error(Object, IndexBounds)")]
+fn test_slice_out_of_bounds_start_host_side() {
+    let env = Env::default();
+    let v: Vec<u32> = vec![&env, 1, 2, 3];
+    let _ = v.slice(4..);
+}
+
+#[test]
+fn test_slice_empty_full_range() {
+    let env = Env::default();
+    let v: Vec<u32> = vec![&env];
+    let sliced = v.slice(..);
+    assert_eq!(sliced.len(), 0);
+}
+
+#[test]
+fn test_slice_empty_zero_range() {
+    let env = Env::default();
+    let v: Vec<u32> = vec![&env];
+    let sliced = v.slice(0..0);
+    assert_eq!(sliced.len(), 0);
+}

soroban-sdk/src/unwrap.rs+23 −0 modified

@@ -3,6 +3,7 @@ use core::convert::Infallible;
 pub trait UnwrapOptimized {
     type Output;
     fn unwrap_optimized(self) -> Self::Output;
+    fn expect_optimized(self, msg: &'static str) -> Self::Output;
 }
 
 impl<T> UnwrapOptimized for Option<T> {
@@ -18,6 +19,17 @@ impl<T> UnwrapOptimized for Option<T> {
         #[cfg(not(target_family = "wasm"))]
         self.unwrap()
     }
+
+    #[inline(always)]
+    fn expect_optimized(self, _msg: &'static str) -> Self::Output {
+        #[cfg(target_family = "wasm")]
+        match self {
+            Some(t) => t,
+            None => core::arch::wasm32::unreachable(),
+        }
+        #[cfg(not(target_family = "wasm"))]
+        self.expect(_msg)
+    }
 }
 
 impl<T, E: core::fmt::Debug> UnwrapOptimized for Result<T, E> {
@@ -33,6 +45,17 @@ impl<T, E: core::fmt::Debug> UnwrapOptimized for Result<T, E> {
         #[cfg(not(target_family = "wasm"))]
         self.unwrap()
     }
+
+    #[inline(always)]
+    fn expect_optimized(self, _msg: &'static str) -> Self::Output {
+        #[cfg(target_family = "wasm")]
+        match self {
+            Ok(t) => t,
+            Err(_) => core::arch::wasm32::unreachable(),
+        }
+        #[cfg(not(target_family = "wasm"))]
+        self.expect(_msg)
+    }
 }
 
 pub trait UnwrapInfallible {

soroban-sdk/src/vec.rs+6 −2 modified

@@ -750,11 +750,15 @@ impl<T> Vec<T> {
     pub fn slice(&self, r: impl RangeBounds<u32>) -> Self {
         let start_bound = match r.start_bound() {
             Bound::Included(s) => *s,
-            Bound::Excluded(s) => *s + 1,
+            Bound::Excluded(s) => s
+                .checked_add(1)
+                .expect_optimized("attempt to add with overflow"),
             Bound::Unbounded => 0,
         };
         let end_bound = match r.end_bound() {
-            Bound::Included(s) => *s + 1,
+            Bound::Included(s) => s
+                .checked_add(1)
+                .expect_optimized("attempt to add with overflow"),
             Bound::Excluded(s) => *s,
             Bound::Unbounded => self.len(),
         };

59fcef437260

Fix range bound overflow in Vec/Bytes slice and GenRange gen_range for u64 (#1703)

https://github.com/stellar/rs-soroban-sdkLeighJan 28, 2026via ghsa

commit

8 files changed · +321 −6

soroban-sdk/src/bytes.rs+6 −2 modified

@@ -739,11 +739,15 @@ impl Bytes {
     pub fn slice(&self, r: impl RangeBounds<u32>) -> Self {
         let start_bound = match r.start_bound() {
             Bound::Included(s) => *s,
-            Bound::Excluded(s) => *s + 1,
+            Bound::Excluded(s) => s
+                .checked_add(1)
+                .expect_optimized("attempt to add with overflow"),
             Bound::Unbounded => 0,
         };
         let end_bound = match r.end_bound() {
-            Bound::Included(s) => *s + 1,
+            Bound::Included(s) => s
+                .checked_add(1)
+                .expect_optimized("attempt to add with overflow"),
             Bound::Excluded(s) => *s,
             Bound::Unbounded => self.len(),
         };

soroban-sdk/src/prng.rs+6 −2 modified

@@ -469,12 +469,16 @@ impl GenRange for u64 {
         assert_in_contract!(env);
         let start_bound = match r.start_bound() {
             Bound::Included(b) => *b,
-            Bound::Excluded(b) => *b + 1,
+            Bound::Excluded(b) => b
+                .checked_add(1)
+                .expect_optimized("attempt to add with overflow"),
             Bound::Unbounded => u64::MIN,
         };
         let end_bound = match r.end_bound() {
             Bound::Included(b) => *b,
-            Bound::Excluded(b) => *b - 1,
+            Bound::Excluded(b) => b
+                .checked_sub(1)
+                .expect_optimized("attempt to subtract with overflow"),
             Bound::Unbounded => u64::MAX,
         };
         internal::Env::prng_u64_in_inclusive_range(env, start_bound, end_bound).unwrap_infallible()

soroban-sdk/src/tests/bytes_slice.rs+83 −0 added

@@ -0,0 +1,83 @@
+use core::ops::Bound;
+
+use crate::{Bytes, Env};
+
+#[test]
+fn test_slice_full_range() {
+    let env = Env::default();
+    let bytes = Bytes::from_slice(&env, &[1, 2, 3]);
+    let sliced = bytes.slice(0..3);
+    assert_eq!(sliced.len(), 3);
+    assert_eq!(sliced.get_unchecked(0), 1);
+    assert_eq!(sliced.get_unchecked(1), 2);
+    assert_eq!(sliced.get_unchecked(2), 3);
+}
+
+#[test]
+fn test_slice_middle() {
+    let env = Env::default();
+    let bytes = Bytes::from_slice(&env, &[1, 2, 3]);
+    let sliced = bytes.slice(1..2);
+    assert_eq!(sliced.len(), 1);
+    assert_eq!(sliced.get_unchecked(0), 2);
+}
+
+// Excluded(u32::MAX) start computes u32::MAX + 1 which overflows.
+#[test]
+#[should_panic(expected = "attempt to add with overflow")]
+fn test_slice_excluded_start_u32_max_overflows_panics_guest_side() {
+    let env = Env::default();
+    let bytes = Bytes::from_slice(&env, &[1, 2, 3]);
+    let _ = bytes.slice((Bound::Excluded(u32::MAX), Bound::Unbounded));
+}
+
+// Included(u32::MAX) end computes u32::MAX + 1 which overflows.
+#[test]
+#[should_panic(expected = "attempt to add with overflow")]
+fn test_slice_included_end_u32_max_overflows_panics_guest_side() {
+    let env = Env::default();
+    let bytes = Bytes::from_slice(&env, &[1, 2, 3]);
+    let _ = bytes.slice(0..=u32::MAX);
+}
+
+// Both bounds u32::MAX: Excluded start computes u32::MAX + 1 which overflows,
+// and Included end computes u32::MAX + 1 which also overflows.
+#[test]
+#[should_panic(expected = "attempt to add with overflow")]
+fn test_slice_both_u32_max_overflows_panics_guest_side() {
+    let env = Env::default();
+    let bytes = Bytes::from_slice(&env, &[1, 2, 3]);
+    let _ = bytes.slice(u32::MAX..=u32::MAX);
+}
+
+#[test]
+#[should_panic(expected = "HostError: Error(Object, IndexBounds)")]
+fn test_slice_out_of_bounds_end_host_side() {
+    let env = Env::default();
+    let bytes = Bytes::from_slice(&env, &[1, 2, 3]);
+    let _ = bytes.slice(0..4);
+}
+
+#[test]
+#[should_panic(expected = "HostError: Error(Object, IndexBounds)")]
+fn test_slice_out_of_bounds_start_host_side() {
+    let env = Env::default();
+    let bytes = Bytes::from_slice(&env, &[1, 2, 3]);
+    let _ = bytes.slice(4..);
+}
+
+#[test]
+fn test_slice_empty_full_range() {
+    let env = Env::default();
+    let bytes = Bytes::new(&env);
+    let sliced = bytes.slice(..);
+    assert_eq!(sliced.len(), 0);
+}
+
+#[test]
+fn test_slice_empty_zero_range() {
+    let env = Env::default();
+    let bytes = Bytes::new(&env);
+    let sliced = bytes.slice(0..0);
+    assert_eq!(sliced.len(), 0);
+}

soroban-sdk/src/tests/prng_range.rs+111 −0 added

@@ -0,0 +1,111 @@
+use core::ops::Bound;
+
+use crate::{self as soroban_sdk, testutils::EnvTestConfig, Env};
+use soroban_sdk::contract;
+
+#[contract]
+pub struct TestPrngRangeContract;
+
+#[test]
+fn test_gen_range_u64_full_range() {
+    let env = Env::new_with_config(EnvTestConfig {
+        capture_snapshot_at_drop: false,
+    });
+    let id = env.register(TestPrngRangeContract, ());
+    env.as_contract(&id, || {
+        let _: u64 = env.prng().gen_range(..);
+    });
+}
+
+#[test]
+fn test_gen_range_u64_inclusive() {
+    let env = Env::new_with_config(EnvTestConfig {
+        capture_snapshot_at_drop: false,
+    });
+    let id = env.register(TestPrngRangeContract, ());
+    env.as_contract(&id, || {
+        for _ in 0..100 {
+            let val: u64 = env.prng().gen_range(5..=10);
+            assert!(val >= 5 && val <= 10);
+        }
+    });
+}
+
+#[test]
+fn test_gen_range_u64_exclusive_end() {
+    let env = Env::new_with_config(EnvTestConfig {
+        capture_snapshot_at_drop: false,
+    });
+    let id = env.register(TestPrngRangeContract, ());
+    env.as_contract(&id, || {
+        for _ in 0..100 {
+            let val: u64 = env.prng().gen_range(5..10);
+            assert!(val >= 5 && val < 10);
+        }
+    });
+}
+
+#[test]
+fn test_gen_range_u64_single_value() {
+    let env = Env::new_with_config(EnvTestConfig {
+        capture_snapshot_at_drop: false,
+    });
+    let id = env.register(TestPrngRangeContract, ());
+    env.as_contract(&id, || {
+        let val: u64 = env.prng().gen_range(7..=7);
+        assert_eq!(val, 7);
+    });
+}
+
+// Excluded(u64::MAX) start computes u64::MAX + 1 which overflows.
+#[test]
+#[should_panic(expected = "attempt to add with overflow")]
+fn test_gen_range_u64_excluded_start_u64_max_overflows() {
+    let env = Env::new_with_config(EnvTestConfig {
+        capture_snapshot_at_drop: false,
+    });
+    let id = env.register(TestPrngRangeContract, ());
+    env.as_contract(&id, || {
+        let _: u64 = env
+            .prng()
+            .gen_range((Bound::Excluded(u64::MAX), Bound::Unbounded));
+    });
+}
+
+#[test]
+fn test_gen_range_u64_included_end_u64_max() {
+    let env = Env::new_with_config(EnvTestConfig {
+        capture_snapshot_at_drop: false,
+    });
+    let id = env.register(TestPrngRangeContract, ());
+    env.as_contract(&id, || {
+        let _: u64 = env.prng().gen_range(0u64..=u64::MAX);
+    });
+}
+
+// Excluded(0) end computes 0 - 1 which underflows.
+#[should_panic(expected = "attempt to subtract with overflow")]
+#[test]
+fn test_gen_range_u64_excluded_end_zero_underflows() {
+    let env = Env::new_with_config(EnvTestConfig {
+        capture_snapshot_at_drop: false,
+    });
+    let id = env.register(TestPrngRangeContract, ());
+    env.as_contract(&id, || {
+        let _: u64 = env
+            .prng()
+            .gen_range((Bound::<u64>::Unbounded, Bound::Excluded(0)));
+    });
+}
+
+#[test]
+fn test_gen_range_u64_both_u64_max() {
+    let env = Env::new_with_config(EnvTestConfig {
+        capture_snapshot_at_drop: false,
+    });
+    let id = env.register(TestPrngRangeContract, ());
+    env.as_contract(&id, || {
+        let val: u64 = env.prng().gen_range(u64::MAX..=u64::MAX);
+        assert_eq!(val, u64::MAX);
+    });
+}

soroban-sdk/src/tests.rs+3 −0 modified

@@ -5,6 +5,7 @@ mod address_payload;
 mod auth;
 mod bytes_alloc_vec;
 mod bytes_buffer;
+mod bytes_slice;
 mod cmp_across_env_in_tests;
 mod contract_add_i32;
 mod contract_assert;
@@ -40,7 +41,9 @@ mod env;
 mod max_ttl;
 mod muxed_address;
 mod prng;
+mod prng_range;
 mod proptest_scval_cmp;
 mod proptest_val_cmp;
 mod storage_testutils;
 mod token_client;
+mod vec_slice;

soroban-sdk/src/tests/vec_slice.rs+83 −0 added

@@ -0,0 +1,83 @@
+use core::ops::Bound;
+
+use crate::{vec, Env, Vec};
+
+#[test]
+fn test_slice_full_range() {
+    let env = Env::default();
+    let v: Vec<u32> = vec![&env, 1, 2, 3];
+    let sliced = v.slice(0..3);
+    assert_eq!(sliced.len(), 3);
+    assert_eq!(sliced.get_unchecked(0), 1);
+    assert_eq!(sliced.get_unchecked(1), 2);
+    assert_eq!(sliced.get_unchecked(2), 3);
+}
+
+#[test]
+fn test_slice_middle() {
+    let env = Env::default();
+    let v: Vec<u32> = vec![&env, 1, 2, 3];
+    let sliced = v.slice(1..2);
+    assert_eq!(sliced.len(), 1);
+    assert_eq!(sliced.get_unchecked(0), 2);
+}
+
+// Excluded(u32::MAX) start computes u32::MAX + 1 which overflows.
+#[test]
+#[should_panic(expected = "attempt to add with overflow")]
+fn test_slice_excluded_start_u32_max_overflows_panics_guest_side() {
+    let env = Env::default();
+    let v: Vec<u32> = vec![&env, 1, 2, 3];
+    let _ = v.slice((Bound::Excluded(u32::MAX), Bound::Unbounded));
+}
+
+// Included(u32::MAX) end computes u32::MAX + 1 which overflows.
+#[test]
+#[should_panic(expected = "attempt to add with overflow")]
+fn test_slice_included_end_u32_max_overflows_panics_guest_side() {
+    let env = Env::default();
+    let v: Vec<u32> = vec![&env, 1, 2, 3];
+    let _ = v.slice(0..=u32::MAX);
+}
+
+// Both bounds u32::MAX: Excluded start computes u32::MAX + 1 which overflows,
+// and Included end computes u32::MAX + 1 which also overflows.
+#[test]
+#[should_panic(expected = "attempt to add with overflow")]
+fn test_slice_both_u32_max_overflows_panics_guest_side() {
+    let env = Env::default();
+    let v: Vec<u32> = vec![&env, 1, 2, 3];
+    let _ = v.slice(u32::MAX..=u32::MAX);
+}
+
+#[test]
+#[should_panic(expected = "HostError: Error(Object, IndexBounds)")]
+fn test_slice_out_of_bounds_end_host_side() {
+    let env = Env::default();
+    let v: Vec<u32> = vec![&env, 1, 2, 3];
+    let _ = v.slice(0..4);
+}
+
+#[test]
+#[should_panic(expected = "HostError: Error(Object, IndexBounds)")]
+fn test_slice_out_of_bounds_start_host_side() {
+    let env = Env::default();
+    let v: Vec<u32> = vec![&env, 1, 2, 3];
+    let _ = v.slice(4..);
+}
+
+#[test]
+fn test_slice_empty_full_range() {
+    let env = Env::default();
+    let v: Vec<u32> = vec![&env];
+    let sliced = v.slice(..);
+    assert_eq!(sliced.len(), 0);
+}
+
+#[test]
+fn test_slice_empty_zero_range() {
+    let env = Env::default();
+    let v: Vec<u32> = vec![&env];
+    let sliced = v.slice(0..0);
+    assert_eq!(sliced.len(), 0);
+}

soroban-sdk/src/unwrap.rs+23 −0 modified

@@ -3,6 +3,7 @@ use core::convert::Infallible;
 pub trait UnwrapOptimized {
     type Output;
     fn unwrap_optimized(self) -> Self::Output;
+    fn expect_optimized(self, msg: &'static str) -> Self::Output;
 }
 
 impl<T> UnwrapOptimized for Option<T> {
@@ -18,6 +19,17 @@ impl<T> UnwrapOptimized for Option<T> {
         #[cfg(not(target_family = "wasm"))]
         self.unwrap()
     }
+
+    #[inline(always)]
+    fn expect_optimized(self, _msg: &'static str) -> Self::Output {
+        #[cfg(target_family = "wasm")]
+        match self {
+            Some(t) => t,
+            None => core::arch::wasm32::unreachable(),
+        }
+        #[cfg(not(target_family = "wasm"))]
+        self.expect(_msg)
+    }
 }
 
 impl<T, E: core::fmt::Debug> UnwrapOptimized for Result<T, E> {
@@ -33,6 +45,17 @@ impl<T, E: core::fmt::Debug> UnwrapOptimized for Result<T, E> {
         #[cfg(not(target_family = "wasm"))]
         self.unwrap()
     }
+
+    #[inline(always)]
+    fn expect_optimized(self, _msg: &'static str) -> Self::Output {
+        #[cfg(target_family = "wasm")]
+        match self {
+            Ok(t) => t,
+            Err(_) => core::arch::wasm32::unreachable(),
+        }
+        #[cfg(not(target_family = "wasm"))]
+        self.expect(_msg)
+    }
 }
 
 pub trait UnwrapInfallible {

soroban-sdk/src/vec.rs+6 −2 modified

@@ -783,11 +783,15 @@ impl<T> Vec<T> {
     pub fn slice(&self, r: impl RangeBounds<u32>) -> Self {
         let start_bound = match r.start_bound() {
             Bound::Included(s) => *s,
-            Bound::Excluded(s) => *s + 1,
+            Bound::Excluded(s) => s
+                .checked_add(1)
+                .expect_optimized("attempt to add with overflow"),
             Bound::Unbounded => 0,
         };
         let end_bound = match r.end_bound() {
-            Bound::Included(s) => *s + 1,
+            Bound::Included(s) => s
+                .checked_add(1)
+                .expect_optimized("attempt to add with overflow"),
             Bound::Excluded(s) => *s,
             Bound::Unbounded => self.len(),
         };

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

github.com/advisories/GHSA-96xm-fv9w-pf3fghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2026-24889ghsaADVISORY
github.com/stellar/rs-soroban-sdk/commit/3890521426d71bb4d892b21f5a283a1e836cfa38ghsax_refsource_MISCWEB
github.com/stellar/rs-soroban-sdk/commit/59fcef437260ed4da42d1efb357137a5c166c02eghsax_refsource_MISCWEB
github.com/stellar/rs-soroban-sdk/commit/c2757c6d774dbb28b34a0b77ffe282e59f0f8462ghsax_refsource_MISCWEB
github.com/stellar/rs-soroban-sdk/pull/1703ghsax_refsource_MISCWEB
github.com/stellar/rs-soroban-sdk/releases/tag/v22.0.9ghsax_refsource_MISCWEB
github.com/stellar/rs-soroban-sdk/releases/tag/v23.5.1ghsax_refsource_MISCWEB
github.com/stellar/rs-soroban-sdk/releases/tag/v25.0.2ghsax_refsource_MISCWEB
github.com/stellar/rs-soroban-sdk/security/advisories/GHSA-96xm-fv9w-pf3fghsax_refsource_CONFIRMWEB

News mentions

No linked articles in our index yet.

cvss	0.260
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000