CVE-2024-45039

gnark is a fast zk-SNARK library that offers a high-level API to design circuits. Versions prior to 0.11.0 have a soundness issue - in case of multiple commitments used inside the circuit the prover is able to choose all but the last commitment. As gnark uses the commitments for optimized non-native multiplication, lookup checks etc. as random challenges, then it could impact the soundness of the whole circuit. However, using multiple commitments has been discouraged due to the additional cost to the verifier and it has not been supported in the recursive in-circuit Groth16 verifier and Solidity verifier. gnark's maintainers expect the impact of the issue be very small - only for the users who have implemented the native Groth16 verifier or are using it with multiple commitments. We do not have information of such users. The issue has been patched in version 0.11.0. As a workaround, users should follow gnark maintainers' recommendation to use only a single commitment and then derive in-circuit commitments as needed using the `std/multicommit` package.

• CWE-200

• https://github.com/Consensys/gnark/commit/e7c66b000454f4d2a4ae48c005c34154d4cfc2a2Broken Link
• https://github.com/Consensys/gnark/security/advisories/GHSA-q3hw-3gm4-w5crThird Party Advisory

Published

Sep 6, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-45032A vulnerability has been identified in Industrial Edge Manag…10
• CVE-2024-45033Insufficient Session Expiration vulnerability in Apache Airf…8.1
• CVE-2024-45034Apache Airflow versions before 2.10.1 have a vulnerability t…8.8
• CVE-2024-45036Tophat is a mobile applications testing harness. An Improper…4.3
• CVE-2024-45037The AWS Cloud Development Kit (CDK) is an open-source framew…6.4
• CVE-2024-45038Meshtastic device firmware is a firmware for meshtastic devi…7.5
• CVE-2024-4504A vulnerability, which was classified as critical, has been …7.2
• CVE-2024-45040gnark is a fast zk-SNARK library that offers a high-level AP…5.9
• CVE-2024-45041External Secrets Operator is a Kubernetes operator that inte…8.8
• CVE-2024-45042Ory Kratos is an identity, user management and authenticatio…4.4
• CVE-2024-45043The OpenTelemetry Collector module AWS firehose receiver is …5.3
• CVE-2024-45044Bareos is open source software for backup, archiving, and re…8.8