7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-58157

CVE-2025-58157: gnark affected by denial of service when computing scalar multiplication using fake-GLV algorithm

Impact

For optimizing the scalar multiplication algorithm in circuit for some curves, gnark uses fake-GLV algorithm in case the curve doesn't support true-GLV. For this to work, we need to compute the scalar decomposition using the Half GCD method in gnark-crypto. However, for some of the inputs the algorithm didn't converge quickly enough.

In case the prover accepts untrusted witness, it could lead to denial of service as the prover gets stuck in a very slowly converging loop.

Thanks to @feltroidprime for reporting the issue and proposing a fix.

Patches

The issue has been patched in gnark-crypto commit https://github.com/Consensys/gnark-crypto/commit/56600883e0e9f9b159e9c7000b94e76185ec3d0d. The dependency update is implemented in gnark commit https://github.com/Consensys/gnark/commit/68be6cede36e387ab760725beabd3c96cc94e6dc.

Workarounds

This update doesn't require recompiling the circuits as the issue is in the hint function. The users can update the gnark-crypto dependency to the fixed version.

References

See bug report https://github.com/Consensys/gnark/issues/1483
Fake GLV description https://ethresear.ch/t/fake-glv-you-dont-need-an-efficient-endomorphism-to-implement-glv-like-scalar-multiplication-in-snark-circuits/20394

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-58157

CVE-2025-58157:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/consensys/gnark	go	= 0.12.0	0.13.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a denial of service in the gnark-crypto library, which is a dependency of gnark. The issue stems from the HalfGCD function, used for scalar decomposition in the fake-GLV algorithm, entering a near-infinite loop for specific inputs.

The root cause of this non-terminating loop was a flawed implementation of the QuoRem function, which performs division with remainder on Eisenstein integers. The Euclidean algorithm, on which HalfGCD is based, requires that the remainder of a division is always 'smaller' (in this case, has a smaller norm) than the divisor to guarantee that it terminates. The original QuoRem function did not provide this guarantee.

The patch addresses the vulnerability by replacing the implementation of QuoRem with a correct one that ensures the Euclidean property holds. This, in turn, guarantees the convergence of the HalfGCD algorithm.

During an exploit, a profiler would likely highlight the eisenstein.HalfGCD function as the primary consumer of CPU time, as it contains the non-converging loop. However, the actual bug lies within eisenstein.(*ComplexNumber).QuoRem, which is called by HalfGCD. Therefore, both functions are critical to understanding and identifying the vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.