CVE-2025-58157

Aliases:GHSA-9fvj-xqr2-xwg8GO-2025-3929
Advisory lineage Upstream: 0 Downstream: 2
Analyzed
Published: 29 Aug 2025, 21:21
Last modified:02 Sept 2025, 14:09

Vulnerability Summary

Overall Risk (default)
medium
40/100
CVSS Score
7.5 HIGH
v3.1 (cve.org)
EPSS Score
0.23% LOW
0% probability +0.09%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

29 Aug 2025, 21:21
Published
Vulnerability first disclosed
02 Sept 2025, 14:09
Last Modified
Vulnerability information updated

Description

gnark is a zero-knowledge proof system framework. In version 0.12.0, there is a potential denial of service vulnerability when computing scalar multiplication is using the fake-GLV algorithm. This is because the algorithm didn't converge quickly enough for some of the inputs. This issue has been patched in version 0.13.0.

CVSS Metrics

  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.23%• Percentile: 46%

Techniques & Countermeasures

  • CWE-400•Uncontrolled Resource Consumption

    The product does not properly control the allocation and maintenance of a limited resource.

Affected Systems

  • consensys•gnark

    = 0.12.0 | 0.12.0

  • github.com/consensys•gnark

    ≥ 0.12.0, < 0.13.0 | < 0.13.0

References (6)