VDB
GHSA-fj2x-735w-74vq
GHSA-fj2x-735w-74vq
PUBLISHED
CVSS 7.5 HIGH
gnark-crypto allows unchecked memory allocation during vector deserialization
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| github.com | Consensys/gnark-crypto | 0.19.0, 0.9.1, 0.19.0 |
| Go | github.com/consensys/gnark-crypto | 0.19.0, 0.9.1 |
| github.com | consensys/gnark-crypto | 0.19.0, 0.19.0, 0.9.1 |
| github.com | consensys/gnark-crypto | |
| chainguard | op-geth | 0 |
| wolfi | op-geth | 0 |
| github.com | consensys/gnark-crypto | 0.9.1, 0.19.0, 0.19.0 |
Timeline
- Oct 30, 2025 CVE Published
- Nov 5, 2025 CVE Updated
References
- https://github.com/advisories/GHSA-fj2x-735w-74vq advisory
- https://github.com/Consensys/gnark-crypto/security/advisories/GHSA-fj2x-735w-74vq url
- https://github.com/Consensys/gnark-crypto/pull/759 patch
- https://github.com/Consensys/gnark-crypto/commit/2e7bf9190a0aac896eeec3876c87c77a35661be7 patch
- https://github.com/Consensys/gnark-crypto url
- https://pkg.go.dev/vuln/GO-2025-4087 url