Incorrect Conversion between Numeric Types Affecting soroban-env-host package, versions >=0.0.0
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RUST-SOROBANENVHOST-15440513
- published8 Mar 2026
- disclosed7 Mar 2026
- creditWill Palmeri
Introduced: 7 Mar 2026
New CVE NOT AVAILABLE CWE-681 (opens in a new tab)How to fix?
There is no fixed version for soroban-env-host.
Overview
Affected versions of this package are vulnerable to Incorrect Conversion between Numeric Types in the Val to ScVal conversion process during storage key computation. An attacker can cause unexpected contract failures or transaction rollbacks by triggering a conversion failure and subsequently attempting operations involving MuxedAddress objects. This is only exploitable if a Val conversion failure occurs, a cross-contract call failure is handled gracefully, and a MuxedAddress write is attempted within the same transaction.
Workaround
This vulnerability can be mitigated by ensuring that user input is valid and by avoiding contract invocations from malicious contracts. If a failure occurs, retrying the transaction with proper arguments may resolve the issue.