Improper Check for Unusual or Exceptional Conditions Affecting kora-lib package, versions <2.0.5
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RUST-KORALIB-15669338
- published16 Mar 2026
- disclosed12 Mar 2026
- creditsolanabughunter-glitch
Introduced: 12 Mar 2026
New CVE NOT AVAILABLE CWE-754 (opens in a new tab)How to fix?
Upgrade kora-lib to version 2.0.5 or higher.
Overview
Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions in the reconstruct_system_instruction and reconstruct_spl_token_instruction functions when processing inner instructions with unrecognized types. An attacker can bypass fee payer policy enforcement by crafting transactions that include such unrecognized instructions, causing them to be reconstructed as empty stubs and silently skipped during policy validation.
Note: This is only exploitable if the fee payer holds an authority role (such as withdraw_withheld_authority or permanent_delegate) for Token-2022 accounts, which may occur in misconfigured environments.