https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T02:16:56.108823+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2021-61409 cnvd-2021-61409 2026-10-09T02:16:56.113197+00:00 cnvd-2021-61409 https://cve.radiocsirt.org/vuln/euvd-2026-30188 EUVD-2026-30188 2026-10-09T02:16:56.113230+00:00 EUVD-2026-30188 https://cve.radiocsirt.org/vuln/fkie_cve-2021-38194 fkie_cve-2021-38194 2026-10-09T02:16:56.113244+00:00

An issue was discovered in the ark-r1cs-std crate before 0.3.1 for Rust. It does not enforce any constraints in the FieldVar::mul_by_inverse method. Thus, a prover can produce a proof that is unsound but is nonetheless verified.

 https://cve.radiocsirt.org/vuln/ghsa-qj3v-q2vj-4c8h GHSA-qj3v-q2vj-4c8h — Calculation error in ark-r1cs-std 2026-10-09T02:16:56.113271+00:00

Affected: crates.io: ark-r1cs-std

An issue was discovered in the ark-r1cs-std crate before 0.3.1 for Rust. It does not enforce any constraints in the FieldVar::mul_by_inverse method. Thus, a prover can produce a proof that is unsound but is nonetheless verified.

 https://cve.radiocsirt.org/vuln/gsd-2021-38194 gsd-2021-38194 2026-10-09T02:16:56.113293+00:00 gsd-2021-38194 https://cve.radiocsirt.org/vuln/rustsec-2021-0075 RUSTSEC-2021-0075 — Flaw in `FieldVar::mul_by_inverse` allows unsound R1CS constraint systems 2026-10-09T02:16:56.113304+00:00

Affected: crates.io: ark-r1cs-std

Versions `0.2.0` to `0.3.0` of ark-r1cs-std did not enforce any constraints in the `FieldVar::mul_by_inverse` method, allowing a malicious prover to produce an unsound proof that passes all verifier checks. This method was used primarily in scalar multiplication for [`short_weierstrass::ProjectiveVar`](https://docs.rs/ark-r1cs-std/0.3.0/ark_r1cs_std/groups/curves/short_weierstrass/struct.ProjectiveVar.html).

This bug was fixed in commit `47ddbaa`, and was released as part of version `0.3.1` on `crates.io`.