CVE-2023-44378: high-severity vulnerability in Consensys gnark
gnark vulnerable to unsoundness in variable comparison/non-unique binary decomposition
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.1epss 0.2%
gnark is a zk-SNARK library that offers a high-level API to design circuits. Prior to version 0.9.0, for some in-circuit values, it is possible to construct two valid decomposition to bits. In addition to the canonical decomposition of `a`, for small values there exists a second decomposition for `a+r` (where `r` is the modulus the values are being reduced by). The second decomposition was possible due to overflowing the field where the values are defined. Upgrading to version 0.9.0 should fix the issue without needing to change the calls to value comparison methods.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Affected products
Consensys · gnarkRelated CVEs — Consensys gnark
In the same product, most dangerous first.
CVE-2025-58157HIGHgnark affected by denial of service when computing scalar multiplication using fake-GLV algorithmEPSS 0.5%CVE-2024-45040MEDIUMgnark's commitments to private witnesses in Groth16 as implemented break zero-knowledge propertyEPSS 0.4%CVE-2024-50354MEDIUMOut-of-memory during deserialization with crafted inputsEPSS 0.3%CVE-2025-57801HIGHgnark is vulnerable to signature malleability in EdDSA and ECDSA due to missing scalar checksEPSS 0.2%CVE-2024-45039MEDIUMgnark's Groth16 commitment extension unsound for more than one commitmentEPSS 0.2%