CVE-2026-46654

Deferred Deferred - Pending Action

Fiat-Shamir Binding Bypass in Plonky3 Toolkit

Publication date: 2026-06-10

Last updated on: 2026-06-10

Assigner: GitHub, Inc.

Description

Plonky3 is a toolkit for polynomial IOPs (PIOPs). Prior to versions 0.4.3 and 0.5.3, an attacker controlling prover-side observations can craft distinct transcripts that produce identical challenges, breaking the binding property of Fiat-Shamir. This issue has been patched in versions 0.4.3 and 0.5.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-10

Last Modified

2026-06-10

Generated

2026-07-01

AI Q&A

2026-06-11

EPSS Evaluated

2026-06-30

NVD

CVE-2026-46654

Affected Vendors & Products

Vendor	Product	Version / Range
plonky3	plonky3	to 0.5.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1240	To fulfill the need for a cryptographic primitive, the product implements a cryptographic algorithm using a non-standard, unproven, or disallowed/non-compliant cryptographic implementation.
CWE-345	The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

Executive Summary

This vulnerability affects Plonky3, a toolkit for polynomial interactive oracle proofs (PIOPs). Before versions 0.4.3 and 0.5.3, an attacker who can control prover-side observations can create different transcripts that result in the same challenges. This breaks the binding property of the Fiat-Shamir transform, which is critical for ensuring the integrity and uniqueness of cryptographic proofs.

Impact Analysis

The vulnerability allows an attacker to produce distinct proof transcripts that yield identical challenges, undermining the binding property of the Fiat-Shamir transform. This can lead to a loss of trust in the cryptographic proofs generated by Plonky3, potentially allowing malicious actors to forge or manipulate proofs, which could compromise the security guarantees of systems relying on this toolkit.

Mitigation Strategies

To mitigate this vulnerability, update Plonky3 to version 0.4.3 or 0.5.3 or later, as these versions contain the patch that fixes the issue with the binding property of Fiat-Shamir.

Detection Guidance

This vulnerability affects the MultiField32Challenger component in the Plonky3 library, specifically in versions prior to 0.4.3 and 0.5.3. Detection involves identifying whether your system is running a vulnerable version of the p3-challenger Rust package.

Since the issue is related to transcript malleability and challenge entropy in the Fiat-Shamir sponge implementation, direct network or system detection commands are not provided in the available resources.

To detect if the vulnerable package is installed, you can check the version of Plonky3 or p3-challenger in your environment. For example, if you use Cargo (Rust's package manager), you can run:

cargo tree | grep p3-challenger
cargo search plonky3

If the version is earlier than 0.4.3 or 0.5.3, your system is vulnerable and should be updated.

Compliance Impact

The provided information does not specify how the vulnerability in Plonky3 impacts compliance with common standards and regulations such as GDPR or HIPAA.

Hi! I’m here to help you understand CVE-2026-46654. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70