CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 31/10/2024 |
| CVE-2024-45040 | MEDIUM5.9 | gnark is a fast zk-SNARK library that offers a high-level API to design circuits. Prior to version 0.11.0, commitments to private witnesses in Groth16 as implemented break the zero-knowledge property. The vulnerability affects only Groth16 proofs with commitments. Notably, PLONK proofs are not affected. The vulnerabili | 06/09/2024 |
| CVE-2024-45039 | MEDIUM6.2 | gnark is a fast zk-SNARK library that offers a high-level API to design circuits. Versions prior to 0.11.0 have a soundness issue - in case of multiple commitments used inside the circuit the prover is able to choose all but the last commitment. As gnark uses the commitments for optimized non-native multiplication, loo | 06/09/2024 |
| GO-2023-2333 | Range checker gadget allows wider inputs than allowed in github.com/consensys/gnark | 15/11/2023 |
| GHSA-rjjm-x32p-m3f7 | LOW3.2 | gnark's range checker gadget allows wider inputs up to word alignment | 12/11/2023 |
| GO-2023-2119 | Proof forgery due to insufficient randomness in github.com/consensys/gnark | 24/10/2023 |
| GHSA-7p92-x423-vwj6 | CRITICAL | Plonk verifier KZG multi point verification | 17/10/2023 |
| CVE-2023-44378 | MEDIUM5.5 | gnark is a zk-SNARK library that offers a high-level API to design circuits. Prior to version 0.9.0, for some in-circuit values, it is possible to construct two valid decomposition to bits. In addition to the canonical decomposition of `a`, for small values there exists a second decomposition for `a+r` (where `r` is th | 09/10/2023 |