https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 23:32:12 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-292105 EUVD-2026-292105 https://cve.radiocsirt.org/vuln/euvd-2026-292105 https://cve.radiocsirt.org/vuln/fkie_cve-2026-40323 <p>SP1 is a zero‑knowledge virtual machine that proves the correct execution of programs compiled for the RISC-V architecture. In versions 6.0.0 through 6.0.2, a soundness vulnerability in the SP1 V6 recursive shard verifier allows a malicious prover to construct a recursive proof from a shard proof that the native verifier would reject. Version 6.1.0 fixes the issue.</p> <p>SP1 is a zero‑knowledge virtual machine that proves the correct execution of programs compiled for the RISC-V architecture. In versions 6.0.0 through 6.0.2, a soundness vulnerability in the SP1 V6 recursive shard verifier allows a malicious prover to construct a recursive proof from a shard proof that the native verifier would reject. Version 6.1.0 fixes the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-40323 https://cve.radiocsirt.org/vuln/ghsa-63x8-x938-vx33 <p><strong>Affected:</strong> crates.io: sp1_sdk, crates.io: sp1_recursion_circuit, crates.io: sp1_prover</p> <p>## Summary</p> <p>A soundness vulnerability in the SP1 V6 recursive shard verifier allows a malicious prover to construct a recursive proof from a shard proof that the native verifier would reject.</p> <p>- **Affected versions:** `&gt;= 6.0.0, &lt;= 6.0.2` - **Not affected:** SP1 V5 (all versions) - **Severity:** High</p> <p>## Details</p> <p>### Background</p> <p>The recursive shard verifier circuit verifies shard proofs inside a recursive proof. Each shard proof includes a jagged PCS opening, which binds trace-shape metadata into a modified commitment and uses that same shape to evaluate the committed polynomials. These two operations must agree on the committed table heights.</p> <p>### The Bug</p> <p>In the V6 recursion circuit&#39;s jagged verifier, the two checks above are served by separate witnesses: a vector of row counts hashed into the modified commitment (commitment side), and a separate witness of prefix sums derived from row and column counts that drives the jagged polynomial evaluator (evaluation side). The prefix sums are observed within the shard verifier.</p> <p>The consistency check between these two witnesses was missing in the recursion sub-circuit describing the jagged PCS verifier. A malicious prover can therefore supply one trace shape for commitment binding and a different shape for polynomial evaluation.</p> <p>### Potential Impact</p> <p>The vulnerability applies to both main trace and preprocessed trace metadata. Because preprocessed traces encode circuit structure (selectors, fixed columns, permutation layout), the…</p> <p><strong>Affected:</strong> crates.io: sp1_sdk, crates.io: sp1_recursion_circuit, crates.io: sp1_prover</p> <p>## Summary</p> <p>A soundness vulnerability in the SP1 V6 recursive shard verifier allows a malicious prover to construct a recursive proof from a shard proof that the native verifier would reject.</p> <p>- **Affected versions:** `&gt;= 6.0.0, &lt;= 6.0.2` - **Not affected:** SP1 V5 (all versions) - **Severity:** High</p> <p>## Details</p> <p>### Background</p> <p>The recursive shard verifier circuit verifies shard proofs inside a recursive proof. Each shard proof includes a jagged PCS opening, which binds trace-shape metadata into a modified commitment and uses that same shape to evaluate the committed polynomials. These two operations must agree on the committed table heights.</p> <p>### The Bug</p> <p>In the V6 recursion circuit&#39;s jagged verifier, the two checks above are served by separate witnesses: a vector of row counts hashed into the modified commitment (commitment side), and a separate witness of prefix sums derived from row and column counts that drives the jagged polynomial evaluator (evaluation side). The prefix sums are observed within the shard verifier.</p> <p>The consistency check between these two witnesses was missing in the recursion sub-circuit describing the jagged PCS verifier. A malicious prover can therefore supply one trace shape for commitment binding and a different shape for polynomial evaluation.</p> <p>### Potential Impact</p> <p>The vulnerability applies to both main trace and preprocessed trace metadata. Because preprocessed traces encode circuit structure (selectors, fixed columns, permutation layout), the…</p> https://cve.radiocsirt.org/vuln/ghsa-63x8-x938-vx33