Executive brief
Commitments to private witnesses in Groth16 as implemented break zero-knowledge property in github.com/consensys/gnark
Affected products
- Go github.com/consensys/gnark
Junglewise Threat Intelligence
CVE-2024-45040: GO-2024-3123 - Commitments to private witnesses in Groth16 as implemented break zero-knowledge property in github.com/consensys/gnark
CVE-2024-45040 · Severity: low · CVSS 3.1 · Published 2024-09-13
Technologies: github.com/consensys/gnark (Go). Vendors: Go.
Related threats
- GO-2025-3929 - Denial of service when computing scalar multiplication using fake-GLV algorithm in github.com/consensys/gnark
- GO-2025-3912 - Gnark is vulnerable to signature malleability in EdDSA and ECDSA due to missing scalar checks in github.com/consensys/gnark
- GO-2024-3122 - Groth16 commitment extension unsound for more than one commitment in github.com/consensys/gnark
- GO-2024-3244 - Gnark out-of-memory during deserialization with crafted inputs in github.com/consensys/gnark
- GO-2023-2333 - Range checker gadget allows wider inputs than allowed in github.com/consensys/gnark