https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 15:10:13 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-251601 EUVD-2026-251601 https://cve.radiocsirt.org/vuln/euvd-2026-251601 https://cve.radiocsirt.org/vuln/fkie_cve-2025-58157 <p>gnark is a zero-knowledge proof system framework. In version 0.12.0, there is a potential denial of service vulnerability when computing scalar multiplication is using the fake-GLV algorithm. This is because the algorithm didn&#39;t converge quickly enough for some of the inputs. This issue has been patched in version 0.13.0.</p> <p>gnark is a zero-knowledge proof system framework. In version 0.12.0, there is a potential denial of service vulnerability when computing scalar multiplication is using the fake-GLV algorithm. This is because the algorithm didn&#39;t converge quickly enough for some of the inputs. This issue has been patched in version 0.13.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-58157 https://cve.radiocsirt.org/vuln/ghsa-9fvj-xqr2-xwg8 <p><strong>Affected:</strong> Go: github.com/consensys/gnark</p> <p>### Impact</p> <p>For optimizing the scalar multiplication algorithm in circuit for some curves, gnark uses fake-GLV algorithm in case the curve doesn&#39;t support true-GLV. For this to work, we need to compute the scalar decomposition using the Half GCD method in gnark-crypto. However, for some of the inputs the algorithm didn&#39;t converge quickly enough.</p> <p>In case the prover accepts untrusted witness, it could lead to denial of service as the prover gets stuck in a very slowly converging loop.</p> <p>Thanks to @feltroidprime for reporting the issue and proposing a fix.</p> <p>### Patches</p> <p>The issue has been patched in gnark-crypto commit https://github.com/Consensys/gnark-crypto/commit/56600883e0e9f9b159e9c7000b94e76185ec3d0d. The dependency update is implemented in gnark commit https://github.com/Consensys/gnark/commit/68be6cede36e387ab760725beabd3c96cc94e6dc.</p> <p>### Workarounds</p> <p>This update doesn&#39;t require recompiling the circuits as the issue is in the hint function. The users can update the gnark-crypto dependency to the fixed version.</p> <p>### References</p> <p>* See bug report https://github.com/Consensys/gnark/issues/1483 * Fake GLV description https://ethresear.ch/t/fake-glv-you-dont-need-an-efficient-endomorphism-to-implement-glv-like-scalar-multiplication-in-snark-circuits/20394</p> <p><strong>Affected:</strong> Go: github.com/consensys/gnark</p> <p>### Impact</p> <p>For optimizing the scalar multiplication algorithm in circuit for some curves, gnark uses fake-GLV algorithm in case the curve doesn&#39;t support true-GLV. For this to work, we need to compute the scalar decomposition using the Half GCD method in gnark-crypto. However, for some of the inputs the algorithm didn&#39;t converge quickly enough.</p> <p>In case the prover accepts untrusted witness, it could lead to denial of service as the prover gets stuck in a very slowly converging loop.</p> <p>Thanks to @feltroidprime for reporting the issue and proposing a fix.</p> <p>### Patches</p> <p>The issue has been patched in gnark-crypto commit https://github.com/Consensys/gnark-crypto/commit/56600883e0e9f9b159e9c7000b94e76185ec3d0d. The dependency update is implemented in gnark commit https://github.com/Consensys/gnark/commit/68be6cede36e387ab760725beabd3c96cc94e6dc.</p> <p>### Workarounds</p> <p>This update doesn&#39;t require recompiling the circuits as the issue is in the hint function. The users can update the gnark-crypto dependency to the fixed version.</p> <p>### References</p> <p>* See bug report https://github.com/Consensys/gnark/issues/1483 * Fake GLV description https://ethresear.ch/t/fake-glv-you-dont-need-an-efficient-endomorphism-to-implement-glv-like-scalar-multiplication-in-snark-circuits/20394</p> https://cve.radiocsirt.org/vuln/ghsa-9fvj-xqr2-xwg8 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15564-1 <p>govulncheck-vulndb-0.0.20250917T170349-1.1 on GA media</p> <p>govulncheck-vulndb-0.0.20250917T170349-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15564-1