CVE-2026-32129: Soroban-Poseidon Hash Collision Vulnerability

CVE-2026-32129 Overview

CVE-2026-32129 is a cryptographic vulnerability affecting the soroban-poseidon library, which provides Poseidon and Poseidon2 cryptographic hash functions for Soroban smart contracts on the Stellar blockchain. The vulnerability exists in Poseidon V1 (PoseidonSponge), which accepts variable-length inputs without implementing injective padding. This flaw enables trivial hash collisions, undermining the cryptographic integrity of any system relying on this hashing mechanism.

Critical Impact

Smart contracts using the vulnerable PoseidonSponge or poseidon_hash functions may be susceptible to hash collision attacks, potentially compromising cryptographic proofs, authentication mechanisms, and data integrity checks within Soroban-based applications.

Affected Products

• soroban-poseidon versions prior to v25.0.1
• Soroban smart contracts using PoseidonSponge or poseidon_hash functions
• Applications where input length is less than T - 1 (e.g., hashing 1 input with T=3)

Discovery Timeline

• 2026-03-12 - CVE CVE-2026-32129 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-32129

Vulnerability Analysis

This vulnerability is classified under CWE-328 (Reversible One-Way Hash), affecting the cryptographic guarantees expected from hash functions. The Poseidon V1 implementation fails to properly differentiate between inputs of varying lengths due to missing injective padding. In cryptographic hash functions, injective padding ensures that different input messages produce distinct internal states before the permutation step.

When a caller provides fewer inputs than the sponge rate (specifically when inputs.len() < T - 1), unused rate positions are implicitly filled with zeros. This creates a dangerous scenario where two semantically different inputs produce identical pre-permutation states, resulting in hash collisions. For any input vector [m1, ..., mk] hashed with a sponge of rate greater than k, the hash output equals hash([m1, ..., mk, 0]) because both inputs result in the same internal state.

Notably, Poseidon2 (Poseidon2Sponge) is not affected by this vulnerability as it implements proper padding mechanisms.

Root Cause

The root cause is the absence of injective padding in the Poseidon V1 sponge construction. When inputs are absorbed into the sponge state, positions not filled by actual input data default to zero without any length encoding or domain separation. This violates a fundamental property of cryptographic hash functions—collision resistance—by allowing trivially constructible collision pairs.

Attack Vector

The attack is network-accessible and requires no authentication or user interaction. An attacker can exploit this vulnerability by crafting inputs that, when processed by the vulnerable hash function, produce the same hash output as legitimate inputs. This could be used to:

• Bypass authentication systems that rely on hash comparisons
• Forge cryptographic proofs in smart contracts
• Create duplicate entries that should be unique based on their hash
• Potentially manipulate financial transactions or token balances in affected smart contracts

For example, if a smart contract uses poseidon_hash to create unique identifiers for assets or verify proofs, an attacker could generate a collision by appending zeros to shorter inputs, allowing them to present fraudulent data that matches legitimate hash values.

Detection Methods for CVE-2026-32129

Indicators of Compromise

• Unexpected duplicate hash values in smart contract storage where uniqueness is expected
• Transaction logs showing multiple distinct inputs resolving to identical hash outputs
• Anomalous behavior in zero-knowledge proof verification systems
• Authentication or authorization bypasses in applications using Poseidon hash for identity verification

Detection Strategies

• Audit smart contract code for usage of PoseidonSponge or poseidon_hash functions with variable-length inputs
• Implement logging to track hash inputs and outputs to identify potential collision exploitation
• Review transaction histories for patterns suggesting hash collision attacks (multiple different inputs producing identical hashes)
• Use static analysis tools to identify vulnerable code patterns where input length is less than T - 1

Monitoring Recommendations

• Monitor smart contract state changes for unexpected duplicate entries
• Implement alerts for authentication events involving hash comparisons that may indicate collision attempts
• Review blockchain transaction logs for suspicious patterns of hash-based operations
• Establish baseline metrics for normal hash function usage and alert on deviations

How to Mitigate CVE-2026-32129

Immediate Actions Required

• Upgrade soroban-poseidon to version v25.0.1 or later immediately
• Audit all deployed smart contracts using Poseidon V1 hash functions for potential vulnerability exposure
• Consider migrating affected contracts to use Poseidon2 (Poseidon2Sponge), which is not vulnerable
• Review any cryptographic proofs or authentication mechanisms built on the affected hash function

Patch Information

The Stellar team has released version v25.0.1 to address this vulnerability. The fix implements proper injective padding to ensure that inputs of different lengths produce distinct pre-permutation states, restoring collision resistance properties to the hash function.

For detailed patch information, see the GitHub Pull Request #10 and the v25.0.1 Release.

Additional security details are available in the GitHub Security Advisory GHSA-g2p6-hh5v-7hfm.

Workarounds

• Use Poseidon2 (Poseidon2Sponge) instead of Poseidon V1 as it is not affected by this vulnerability
• Ensure all inputs to the hash function are padded to a consistent length equal to or greater than T - 1 before hashing
• Implement additional validation layers that check input uniqueness before hash comparisons
• Consider adding application-level length encoding to inputs before passing them to the hash function

# Update soroban-poseidon to the patched version
cargo update -p soroban-poseidon --precise 25.0.1

# Verify the installed version
cargo tree -p soroban-poseidon