CVE-2025-58157CWE-400denial-of-service

CVE-2025-58157

High · published August 30, 2025

CVSS v3.1
7.5
EPSS
1%
Percentile
43.0
In the wild
Unconfirmed
What it is

gnark is a zero-knowledge proof system framework. In version 0.12.0, there is a potential denial of service vulnerability when computing scalar multiplication is using the fake-GLV algorithm. This is because the algorithm didn't converge quickly enough for some of the inputs. This issue has been patched in version 0.13.0.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00515 · 43.0th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2025-08-30T02:15Z
Affected products (1)
ProductVersionsFixed in
consensys/gnarkall versions—
References (4)
https://github.com/Consensys/gnark-crypto/commit/56600883e0e9f9b159e9c7000b94e76185ec3d0d · [email protected]https://github.com/Consensys/gnark/commit/68be6cede36e387ab760725beabd3c96cc94e6dc · [email protected]https://github.com/Consensys/gnark/issues/1483 · [email protected]https://github.com/Consensys/gnark/security/advisories/GHSA-9fvj-xqr2-xwg8 · [email protected]
EPSS history
Timeline
  • 29 AUG 21:21Z
    gnark affected by denial of service when computing scalar multiplication using fake-GLV algorithm
    cvelistv5