CVE-2025-58157
BaseFortify
Publication date: 2025-08-29
Last updated on: 2025-09-24
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| consensys | gnark | 0.12.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-400 | The product does not properly control the allocation and maintenance of a limited resource. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the gnark zero-knowledge proof system framework version 0.12.0. It is a potential denial of service issue caused by the fake-GLV algorithm used for scalar multiplication, which sometimes does not converge quickly enough for certain inputs, leading to performance problems or service disruption. The issue was fixed in version 0.13.0.
How can this vulnerability impact me? :
The vulnerability can cause a denial of service by making the scalar multiplication computation take too long or fail to complete promptly, potentially disrupting the availability of systems using gnark version 0.12.0 with the fake-GLV algorithm.
What immediate steps should I take to mitigate this vulnerability?
Upgrade gnark to version 0.13.0 or later, as this version contains the patch that fixes the denial of service vulnerability in the fake-GLV algorithm.