8.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-46654

CVE-2026-46654: Plonky3 MultiField32Challenger: transcript malleability and challenge entropy loss

Plonky3 is a toolkit for polynomial IOPs (PIOPs). Prior to versions 0.4.3 and 0.5.3, an attacker controlling prover-side observations can craft distinct transcripts that produce identical challenges, breaking the binding property of Fiat-Shamir. This issue has been patched in versions 0.4.3 and 0.5.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-46654

CVE-2026-46654:

8.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
p3-challenger	rust	< 0.4.3	0.4.3
p3-challenger	rust	>= 0.5.0, < 0.5.3	0.5.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability in Plonky3's MultiField32Challenger is a critical flaw in its implementation of the Fiat-Shamir transform, leading to transcript malleability and a loss of entropy in the generated challenges. An attacker could exploit these issues to break the binding property of the proof system.

The root cause lies in the p3_challenger::multi_field_challenger::MultiField32Challenger::duplexing function and its helper functions, p3_field::helpers::reduce_32 and p3_field::helpers::split_32.

Partial-Chunk Aliasing (Absorption Vulnerability): The duplexing function processed input data by calling p3_field::helpers::reduce_32. The reduce_32 function performed a simple base-2^32 packing of smaller field elements into a larger one but failed to incorporate the input's length. This meant that inputs of different lengths could produce the same packed representation if padded with trailing zeros (e.g., [x] and [x, 0, 0]). This allowed an attacker to modify the transcript by adding or removing trailing zero elements without affecting the subsequent challenges. The patch addresses this by introducing length-tagging during the absorption phase.
Non-Injective Squeeze (Squeezing Vulnerability): When generating challenges, duplexing used p3_field::helpers::split_32 to break down a large field element from the sponge's state. split_32 converted u64 limbs into 31-bit field elements using from_u64, which involves a modular reduction. This reduction discarded the upper 33 bits of each u64 limb, meaning different internal sponge states could produce identical challenges, weakening the security of the challenges.
High-Bit Truncation (Configuration Vulnerability): The number of limbs used to represent a larger field element was calculated using integer division (PF::bits() / 64). For fields whose bit-size is not a multiple of 64 (like BN254 with 254 bits), this silently truncated the most significant bits of the element being observed, allowing distinct hash digests to be treated as identical by the challenger.

The identified vulnerable functions are the direct implementations of these flawed mechanisms. Runtime profiling during an exploit would show these functions being called as they process the malformed, prover-controlled inputs. The fix involved a significant refactoring of the challenger logic to use proper domain separation and injective mappings.

Vulnerable functions

p3_challenger::multi_field_challenger::MultiField32Challenger::duplexing

challenger/src/multi_field_challenger.rs

This function was the core of the vulnerability. It improperly handled both the absorption (input) and squeezing (output) phases of the sponge construction. It called the vulnerable `reduce_32` function without any length separation, leading to transcript malleability. It also used the vulnerable `split_32` function, causing a loss of entropy in the challenges. Finally, it had a separate bug where it leaked the secret capacity of the sponge state when generating output.

p3_field::helpers::reduce_32

field/src/helpers.rs

This function packed smaller field elements into a larger one using a base-2^32 encoding. It did not account for the length of the input array. As a result, inputs with different lengths, such as `[x]` and `[x, 0, 0]`, would produce the same output when padded to a fixed size. This allowed an attacker to modify the prover's transcript (e.g., by adding or removing trailing zero elements) without changing the cryptographic challenges, breaking the binding property of the proof system.

p3_field::helpers::split_32

field/src/helpers.rs

This function was responsible for splitting a large field element from the sponge state into smaller 31-bit challenge elements. It did so by taking `u64` limbs and converting them using `from_u64`, which performs a modular reduction. This reduction effectively discards the upper 33 bits of each `u64` limb. Consequently, two different internal sponge states could produce the exact same sequence of challenges, leading to a significant loss of entropy and allowing for potential forgery attacks.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.