Skip to content
OpenAdvisories

Package · Go

github.com/consensys/gnark-crypto

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • High 7.5
    GHSA-fj2x-735w-74vq

    gnark-crypto allows unchecked memory allocation during vector deserialization

    The issue has been reported by @raefko from @fuzzinglabs. Excerpts from the report: > A critical vulnerability exists in the gnark-crypto library's `Vector.ReadFrom()` function that allows an attacker to trigger arbitrary memory allocation by crafting malicio…

    github.com/consensys/gnark-crypto Go
  • Low —
    GHSA-pffg-92cg-xf5c

    gnark-crypto's exponentiation in the pairing target group GT using GLV can give incorrect results

    ### Impact When the exponent is bigger than `r`, the group order of the pairing target group `GT`, the exponentiation à la GLV (`ExpGLV`) can *sometimes* give incorrect results compared to normal exponentiation (`Exp`). The issue impacts all users using `ExpG…

    github.com/consensys/gnark-crypto Go
  • Medium 5.1
    CVE-2023-44273

    gnark-crypto doesn't range check input values during ECDSA and EdDSA signature deserialization

    Consensys gnark-crypto through 0.11.2 allows Signature Malleability. This occurs because deserialisation of EdDSA and ECDSA signatures does not ensure that the data is in a certain interval.

    github.com/consensys/gnark-crypto Go