{"id":"CVE-2026-62335","kind":"vulnerability","aliases":["CVE-2026-62335"],"related":[],"title":"OpenVM: Solidity verifier accepts non-canonical commitments, creating verification ambiguity","description":"OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, `OpenVmHalo2Verifier.verify` accepts `appExeCommit` and `appVmCommit` as `bytes32` values without checking that either is less than the `BN254` scalar field modulus. Although public-value and proof-data lengths are checked, callers can provide non-canonical 256-bit encodings greater than or equal to that modulus at the Solidity wrapper boundary. Applications relying on the wrapper can therefore accept non-canonical app executable and app VM commitments, creating ambiguity between the supplied byte-level values and the field elements used by the verifier. This issue is fixed in versions 1.7.0, 2.0.0-rc.3 and 2.1.0-preview.","summary":"OpenVM's Solidity verifier contract OpenVmHalo2Verifier.verify accepts appExeCommit and appVmCommit values without checking they are below the BN254 field modulus. An attacker can supply non-canonical 256-bit encodings of the same field element, so applications relying on the wrapper may accept commitments that differ at the byte level from the values the verifier actually uses.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ethereum","openvm","package","solidity","zkvm"],"not_affected_if":["hard-coded-commitments","off-chain-only"],"how_to_check":"- Check whether the project depends on OpenVM (`openvm` crate or the OpenVM Solidity verifier contracts) and which version is pinned in the lockfile or `Cargo.toml`.\n- Look for calls to `OpenVmHalo2Verifier.verify` in your Solidity contracts and check whether the app commitments are trusted from callers or hard-coded.\n- Confirm the OpenVM version in use is below `1.7.0`, or is `2.0.0-rc.1`/`2.0.0-rc.2`/`2.1.0` prerelease builds before the fixed prereleases.","fix":"- OpenVM `1.7.0` or later\n- OpenVM `2.0.0-rc.3` or later\n- OpenVM `2.1.0-preview` or later","status":"open","published_at":"2026-10-30T20:17:12+00:00","first_seen_at":"2026-10-30T20:25:39+00:00","triaged_at":"2026-10-30T20:26:45+00:00","updated_at":"2026-10-30T20:26:45+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T20:26:45Z","model":"claude-haiku-5-5","output":{"fix":"- OpenVM `1.7.0` or later\n- OpenVM `2.0.0-rc.3` or later\n- OpenVM `2.1.0-preview` or later","reach":"internet","title":"OpenVM: Solidity verifier accepts non-canonical commitments, creating verification ambiguity","impact":"medium","summary":"OpenVM's Solidity verifier contract OpenVmHalo2Verifier.verify accepts appExeCommit and appVmCommit values without checking they are below the BN254 field modulus. An attacker can supply non-canonical 256-bit encodings of the same field element, so applications relying on the wrapper may accept commitments that differ at the byte level from the values the verifier actually uses.","audience":"developers","category":"package","nicknames":[],"who_cares":["openvm","zkvm","solidity","ethereum"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"non-canonical commitments are accepted, weakening proof-to-program binding","analyst_note":"","how_to_check":"- Check whether the project depends on OpenVM (`openvm` crate or the OpenVM Solidity verifier contracts) and which version is pinned in the lockfile or `Cargo.toml`.\n- Look for calls to `OpenVmHalo2Verifier.verify` in your Solidity contracts and check whether the app commitments are trusted from callers or hard-coded.\n- Confirm the OpenVM version in use is below `1.7.0`, or is `2.0.0-rc.1`/`2.0.0-rc.2`/`2.1.0` prerelease builds before the fixed prereleases.","plain_action":"","needs_analyst":false,"not_affected_if":["off-chain-only","hard-coded-commitments"],"who_is_affected":"Applications that use the OpenVM Halo2 Solidity wrapper and accept app executable or app VM commitments from callers are exposed, because the verifier does not reject non-canonical encodings of those values. Projects that only use OpenVM off-chain, or that hard-code trusted commitments and never take them from users, are unlikely to be affected. The sources do not say how the commitments are used in a given application.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000824,"input_tokens":4309,"output_tokens":787,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-62335':14A,17A '1':97C '1.7.0':94C,199C '2.0':103C '2.0.0':200C '2.1':105C '2.1.0':203C '256':50B,144C 'accept':4A,29B,65B,108C,166C 'actual':78B 'affect':102C 'although':127C 'ambigu':11A,177C 'app':170C,173C 'appexecommit':30B,109C 'applic':59B,159C 'appvmcommit':32B,111C 'attack':44B 'bit':51B,145C 'bn254':40B,123C 'boundari':158C 'built':88C 'byte':71B,182C 'byte-level':181C 'bytes32':113C 'caller':138C 'canon':7A,49B,143C,169C 'check':35B,116C,137C 'commit':8A,66B,175C 'contract':27B 'creat':9A,176C 'custom':90C 'cve':12A,15A 'data':134C 'differ':68B 'either':118C 'element':57B,188C 'encod':52B,146C 'equal':150C 'ethereum':18B 'execut':171C 'extens':92C 'field':41B,56B,125C,187C 'fix':196C 'framework':87C 'greater':147C 'issu':194C 'length':135C 'less':120C 'level':72B,183C 'line':99C 'may':64B 'modular':85C 'modulus':42B,126C,153C 'non':6A,48B,142C,168C 'non-canon':5A,47B,141C,167C 'openvm':1A,19B,23B,80C 'openvmhalo2verifier.verify':28B,107C 'packag':20B 'perform':83C 'prereleas':106C 'preview':204C 'proof':133C 'proof-data':132C 'provid':140C 'public':129C 'public-valu':128C 'rc.3':201C 'reli':60B,160C 'scalar':124C 'solid':2A,21B,25B,156C 'suppli':46B,180C 'therefor':165C 'use':79B,189C 'valu':33B,75B,114C,130C,184C 'verif':10A 'verifi':3A,26B,77B,192C 'version':198C 'vm':174C 'without':34B,115C 'wrapper':63B,157C,163C 'x':98C 'zkvm':22B,86C","nicknames":[],"mitigations":[],"who_affected":"Applications that use the OpenVM Halo2 Solidity wrapper and accept app executable or app VM commitments from callers are exposed, because the verifier does not reject non-canonical encodings of those values. Projects that only use OpenVM off-chain, or that hard-code trusted commitments and never take them from users, are unlikely to be affected. The sources do not say how the commitments are used in a given application.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T20:17:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62335","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62335","severity":null,"published_at":"2026-10-30T20:17:12+00:00","modified_at":"2026-10-30T20:17:12+00:00","first_seen_at":"2026-10-30T20:25:39+00:00","fetched_at":"2026-10-30T20:25:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}