CVE-2025-58157

HIGH EPSS 37.8%
Published Aug 29, 202510mo ago · Modified Jun 17, 20261w ago
7.5 CVSS 3.1
High
Find Similar
Published Aug 29, 2025 10mo ago
Last Modified Jun 17, 2026 1w ago

Description

gnark is a zero-knowledge proof system framework. In version 0.12.0, there is a potential denial of service vulnerability when computing scalar multiplication is using the fake-GLV algorithm. This is because the algorithm didn't converge quickly enough for some of the inputs. This issue has been patched in version 0.13.0.

CVSS Details

Base Score
7.5
Exploitability
3.9
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
37.8% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-400 Uncontrolled Resource Consumption Resource Mgmt

Affected Products 1

VendorProductVersionRange
consensysgnark0.12.0any

References 4

  • github.com https://github.com/Consensys/gnark-crypto/commit/56600883e0e9f9b159e9c7000b94e76185ec3d0d
    Patch
  • github.com https://github.com/Consensys/gnark/commit/68be6cede36e387ab760725beabd3c96cc94e6dc
    Patch
  • github.com https://github.com/Consensys/gnark/issues/1483
    ExploitIssue Tracking
  • github.com https://github.com/Consensys/gnark/security/advisories/GHSA-9fvj-xqr2-xwg8
    Vendor Advisory

Remediation

  • github.com https://github.com/Consensys/gnark-crypto/commit/56600883e0e9f9b159e9c7000b94e76185ec3d0d
    Patch
  • github.com https://github.com/Consensys/gnark/commit/68be6cede36e387ab760725beabd3c96cc94e6dc
    Patch