CVE-2025-58157

{
  "id": "CVE-2025-58157",
  "sourceIdentifier": "[email protected]",
  "published": "2025-08-29T22:15:32.700",
  "lastModified": "2026-10-18T21:10:00.120",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "gnark is a zero-knowledge proof system framework. In version 0.12.0, there is a potential denial of service vulnerability when computing scalar multiplication is using the fake-GLV algorithm. This is because the algorithm didn't converge quickly enough for some of the inputs. This issue has been patched in version 0.13.0."
    },
    {
      "lang": "es",
      "value": "gnark es un framework de sistema de prueba de conocimiento cero. En la versión 0.12.0, existe una potencial vulnerabilidad de denegación de servicio cuando la computación de la multiplicación escalar utiliza el algoritmo fake-GLV. Esto se debe a que el algoritmo no convergía lo suficientemente rápido para algunas de las entradas. Este problema ha sido parcheado en la versión 0.13.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Consensys",
          "product": "gnark",
          "versions": [
            {
              "version": "= 0.12.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-09-02T14:09:34.494455Z",
          "id": "CVE-2025-58157",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:consensys:gnark:0.12.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "BED009EB-B460-444C-8585-8D66B7074444"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/Consensys/gnark-crypto/commit/56600883e0e9f9b159e9c7000b94e76185ec3d0d",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/Consensys/gnark/commit/68be6cede36e387ab760725beabd3c96cc94e6dc",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/Consensys/gnark/issues/1483",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Issue Tracking"
      ]
    },
    {
      "url": "https://github.com/Consensys/gnark/security/advisories/GHSA-9fvj-xqr2-xwg8",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}