Duplicate Advisory: Consensys gnark-crypto allows Signature Malleability

CRITICAL 9.8CVE-2023-44273 · GHSA-9xfq-8j3r-xp5g · GHSA-fr8m-434r-g3xp · Published 28/09/2023 · updated 17/06/2026

In short

CVE-2023-44273 is a CRITICAL (CVSS 9.8) vulnerability affecting github.com/Consensys/gnark-crypto, github.com/consensys/gnark-crypto, gnark-crypto (consensys).
Chance of exploitation in the next 30 days (EPSS): 1.1%, higher than 64.4% of all vulnerabilities.
Fix: update to 0.12.0 or later.

Package	Affected versions	Patched versions
github.com/Consensys/gnark-crypto Go	`< 0.12.0`	`0.12.0`
github.com/consensys/gnark-crypto Go	`< 0.12.0`	`0.12.0`
gnark-crypto consensys	`< 0.12.0`	`0.12.0`

Description

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-fr8m-434r-g3xp. This link is maintained to preserve external references.

Original Description

Consensys gnark-crypto through 0.11.2 allows Signature Malleability. This occurs because deserialisation of EdDSA and ECDSA signatures does not ensure that the data is in a certain interval.

NVD description

Consensys gnark-crypto through 0.11.2 allows Signature Malleability. This occurs because deserialisation of EdDSA and ECDSA signatures does not ensure that the data is in a certain interval.

References

nvd.nist.gov/vuln/detail/CVE-2023-44273 · ADVISORY
Consensys/gnark-crypto#449 · WEB
Consensys/gnark-crypto · PACKAGE
Consensys/gnark-crypto release · WEB
Consensys/gnark-crypto release v0.12.0 · WEB
verichains.io · WEB
Consensys/gnark-crypto security advisory · WEB
go.dev/blog/defer-panic-and-recover · WEB
GitHub Advisory GHSA-9xfq-8j3r-xp5g · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

github.com/Consensys/gnark-crypto

< 0.12.0

0.12.0

github.com/consensys/gnark-crypto

< 0.12.0

0.12.0

gnark-crypto

consensys

< 0.12.0

0.12.0

Description

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-fr8m-434r-g3xp. This link is maintained to preserve external references.

Original Description

Consensys gnark-crypto through 0.11.2 allows Signature Malleability. This occurs because deserialisation of EdDSA and ECDSA signatures does not ensure that the data is in a certain interval.

NVD description

Consensys gnark-crypto through 0.11.2 allows Signature Malleability. This occurs because deserialisation of EdDSA and ECDSA signatures does not ensure that the data is in a certain interval.