CVE-2025-58157

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-58157", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-08-27T13:34:56.186Z", "datePublished": "2025-08-29T21:21:35.677Z", "dateUpdated": "2025-09-02T14:09:48.386Z"}, "containers": {"cna": {"title": "gnark affected by denial of service when computing scalar multiplication using fake-GLV algorithm", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/Consensys/gnark/security/advisories/GHSA-9fvj-xqr2-xwg8", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Consensys/gnark/security/advisories/GHSA-9fvj-xqr2-xwg8"}, {"name": "https://github.com/Consensys/gnark/issues/1483", "tags": ["x_refsource_MISC"], "url": "https://github.com/Consensys/gnark/issues/1483"}, {"name": "https://github.com/Consensys/gnark-crypto/commit/56600883e0e9f9b159e9c7000b94e76185ec3d0d", "tags": ["x_refsource_MISC"], "url": "https://github.com/Consensys/gnark-crypto/commit/56600883e0e9f9b159e9c7000b94e76185ec3d0d"}, {"name": "https://github.com/Consensys/gnark/commit/68be6cede36e387ab760725beabd3c96cc94e6dc", "tags": ["x_refsource_MISC"], "url": "https://github.com/Consensys/gnark/commit/68be6cede36e387ab760725beabd3c96cc94e6dc"}], "affected": [{"vendor": "Consensys", "product": "gnark", "versions": [{"version": "= 0.12.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-08-29T21:21:35.677Z"}, "descriptions": [{"lang": "en", "value": "gnark is a zero-knowledge proof system framework. In version 0.12.0, there is a potential denial of service vulnerability when computing scalar multiplication is using the fake-GLV algorithm. This is because the algorithm didn't converge quickly enough for some of the inputs. This issue has been patched in version 0.13.0."}], "source": {"advisory": "GHSA-9fvj-xqr2-xwg8", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-02T14:09:34.494455Z", "id": "CVE-2025-58157", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-02T14:09:48.386Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-58157", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-02T14:09:34.494455Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-02T14:09:44.231Z"}}], "cna": {"title": "gnark affected by denial of service when computing scalar multiplication using fake-GLV algorithm", "source": {"advisory": "GHSA-9fvj-xqr2-xwg8", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "Consensys", "product": "gnark", "versions": [{"status": "affected", "version": "= 0.12.0"}]}], "references": [{"url": "https://github.com/Consensys/gnark/security/advisories/GHSA-9fvj-xqr2-xwg8", "name": "https://github.com/Consensys/gnark/security/advisories/GHSA-9fvj-xqr2-xwg8", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Consensys/gnark/issues/1483", "name": "https://github.com/Consensys/gnark/issues/1483", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/Consensys/gnark-crypto/commit/56600883e0e9f9b159e9c7000b94e76185ec3d0d", "name": "https://github.com/Consensys/gnark-crypto/commit/56600883e0e9f9b159e9c7000b94e76185ec3d0d", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/Consensys/gnark/commit/68be6cede36e387ab760725beabd3c96cc94e6dc", "name": "https://github.com/Consensys/gnark/commit/68be6cede36e387ab760725beabd3c96cc94e6dc", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "gnark is a zero-knowledge proof system framework. In version 0.12.0, there is a potential denial of service vulnerability when computing scalar multiplication is using the fake-GLV algorithm. This is because the algorithm didn't converge quickly enough for some of the inputs. This issue has been patched in version 0.13.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-08-29T21:21:35.677Z"}}}, "cveMetadata": {"cveId": "CVE-2025-58157", "state": "PUBLISHED", "dateUpdated": "2025-09-02T14:09:48.386Z", "dateReserved": "2025-08-27T13:34:56.186Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-08-29T21:21:35.677Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "gnark", "vendor": "Consensys", "versions": [{"status": "affected", "version": "= 0.12.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:consensys:gnark:0.12.0:*:*:*:*:*:*:*", "matchCriteriaId": "BED009EB-B460-444C-8585-8D66B7074444", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "gnark is a zero-knowledge proof system framework. In version 0.12.0, there is a potential denial of service vulnerability when computing scalar multiplication is using the fake-GLV algorithm. This is because the algorithm didn't converge quickly enough for some of the inputs. This issue has been patched in version 0.13.0."}, {"lang": "es", "value": "gnark es un framework de sistema de prueba de conocimiento cero. En la versi\u00f3n 0.12.0, existe una potencial vulnerabilidad de denegaci\u00f3n de servicio cuando la computaci\u00f3n de la multiplicaci\u00f3n escalar utiliza el algoritmo fake-GLV. Esto se debe a que el algoritmo no converg\u00eda lo suficientemente r\u00e1pido para algunas de las entradas. Este problema ha sido parcheado en la versi\u00f3n 0.13.0."}], "id": "CVE-2025-58157", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-58157", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-02T14:09:34.494455Z", "version": "2.0.3"}}]}, "published": "2025-08-29T22:15:32.700", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/Consensys/gnark-crypto/commit/56600883e0e9f9b159e9c7000b94e76185ec3d0d"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/Consensys/gnark/commit/68be6cede36e387ab760725beabd3c96cc94e6dc"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Issue Tracking"], "url": "https://github.com/Consensys/gnark/issues/1483"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/Consensys/gnark/security/advisories/GHSA-9fvj-xqr2-xwg8"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-08-31T08:41:34.127391+00:00", "updated": "2025-08-31T08:41:34.127483+00:00", "vendors": ["consensys", "consensys$PRODUCT$gnark"]}