CVE-2024-50354CWE-400

Out-of-memory during deserialization with crafted inputs

Medium · published October 31, 2024

CVSS v3.1
5.5
EPSS
0%
Percentile
24.3
In the wild
Unconfirmed
What it is

gnark is a fast zk-SNARK library that offers a high-level API to design circuits. In gnark 0.11.0 and earlier, deserialization of Groth16 verification keys allocate excessive memory, consuming a lot of resources and triggering a crash with the error fatal error: runtime: out of memory.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00325 · 24.3th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2024-10-31T15:59Z
EPSS history
Timeline
  • 31 OCT 15:59Z
    Out-of-memory during deserialization with crafted inputs
    cvelistv5