Live › vulnerability › CVE-2026-62335
OpenVM's Solidity verifier contract OpenVmHalo2Verifier.verify accepts appExeCommit and appVmCommit values without checking they are below the BN254 field modulus. An attacker can supply non-canonical 256-bit encodings of the same field element, so applications relying on the wrapper may accept commitments that differ at the byte level from the values the verifier actually uses.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 20:25 UTC. All times on this page are UTC.
Applications that use the OpenVM Halo2 Solidity wrapper and accept app executable or app VM commitments from callers are exposed, because the verifier does not reject non-canonical encodings of those values. Projects that only use OpenVM off-chain, or that hard-code trusted commitments and never take them from users, are unlikely to be affected. The sources do not say how the commitments are used in a given application.
No product ranges from the sources yet.
openvm crate or the OpenVM Solidity verifier contracts) and which version is pinned in the lockfile or Cargo.toml.OpenVmHalo2Verifier.verify in your Solidity contracts and check whether the app commitments are trusted from callers or hard-coded.1.7.0, or is 2.0.0-rc.1/2.0.0-rc.2/2.1.0 prerelease builds before the fixed prereleases.1.7.0 or later2.0.0-rc.3 or later2.1.0-preview or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, OpenVmHalo2Verifier.verify accepts appExeCommit and appVmCommit as bytes32 values without checking that either is less than the BN254 scalar field modulus. Although public-value and proof-data lengths are checked, callers can provide non-canonical 256-bit encodings greater than or equal to that modulus at the Solidity wrapper boundary. Applications relying on the wrapper can therefore accept non-canonical app executable and app VM commitments, creating ambiguity between the supplied byte-level values and the field elements used by the verifier. This issue is fixed in versions 1.7.0, 2.0.0-rc.3 and 2.1.0-preview.
This page as .md · .json · in your agent: get_signal("CVE-2026-62335")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.