Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/consensys/gnark

6 known vulnerabilities (3 high, 3 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
6 · 3 high, 3 medium
Registry
pkg.go.dev

Advisories 6

  • gnark affected by denial of service when computing scalar multiplication using fake-GLV algorithm

    Affected: from 0.12.0, fixed in 0.13.0; fixed in 0.13.0.

  • gnark is vulnerable to signature malleability in EdDSA and ECDSA due to missing scalar checks

    Affected: fixed in 0.14.0.

  • CVE-2024-50354Medium 5.5

    Out-of-memory during deserialization with crafted inputs

    Affected: fixed in 0.12.0; fixed in 0.11.1.

  • CVE-2024-45039Medium 6.2

    gnark's Groth16 commitment extension unsound for more than one commitment

    Affected: fixed in 0.11.0.

  • CVE-2024-45040Medium 5.9

    gnark's commitments to private witnesses in Groth16 as implemented break zero-knowledge property

    Affected: fixed in 0.11.0.

  • gnark vulnerable to unsoundness in variable comparison/non-unique binary decomposition

    Affected: fixed in 0.9.0.