Vulnerability · Published Aug 29, 2025 · Assigned by GitHub_M

CVE-2025-58157gnark affected by denial of service when computing scalar multiplication using fake-GLV algorithm

High 7.5

In plain English

A high-severity uncontrolled resource consumption in gnark from Consensys. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 54.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

gnark is a zero-knowledge proof system framework. In version 0.12.0, there is a potential denial of service vulnerability when computing scalar multiplication is using the fake-GLV algorithm. This is because the algorithm didn't converge quickly enough for some of the inputs. This issue has been patched in version 0.13.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/consensys/gnark	0.13.0	GHSA-9fvj-xqr2-xwg8
Go	github.com/consensys/gnark	0.13.0	GO-2025-3929

Affected products (as reported)

Vendor	Product	Versions
Consensys	gnark	= 0.12.0

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/Consensys/gnark/security/advisories/GHSA-9fvj-xqr2-xwg8 x_refsource_CONFIRM
https://github.com/Consensys/gnark/issues/1483 x_refsource_MISC
https://github.com/Consensys/gnark-crypto/commit/56600883e0e9f9b159e9c7000b94e76185ec3d0d x_refsource_MISC
https://github.com/Consensys/gnark/commit/68be6cede36e387ab760725beabd3c96cc94e6dc x_refsource_MISC