Live › vulnerability › CVE-2026-62337
SNARK Verifier is a generic (S)NARK verifier library; before 0.2.5 a prover-supplied proof point encoded as (0, 0) can enter the Halo 2 aggregation sum through a scalar-one shortcut. An attacker who controls a proof may influence the multi-scalar multiplication or accumulator result, though the advisory does not establish that invalid proofs are universally accepted.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 20:25 UTC. All times on this page are UTC.
Teams that use the SNARK Verifier crate to verify Halo 2 aggregation proofs, especially where proof points come from an untrusted prover. Systems that do not run the Halo 2 aggregation circuit or do not verify untrusted proofs with this crate are less exposed. The advisory notes that practical exploitability depends on the surrounding aggregation and final-decider checks.
No product ranges from the sources yet.
snark-verifier crate version in Cargo.lock and confirm whether it is below 0.2.5.EcPointLoader::multi_scalar_multiplication in your verifier code.snark-verifier 0.2.5Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SNARK Verifier is a generic (S)NARK verifier. Prior to 0.2.5, the Halo 2 aggregation circuit can mishandle proof points encoded as the point at infinity. EcPointLoader::multi_scalar_multiplication places a Value::Assigned(_) base paired with Value::Constant(ONE) into its unscaled variable-base list and passes it directly to sum_with_const. The default shim delegates to halo2-lib EccChip::sum, whose incomplete affine addition assumes nonidentity input points. A prover-controlled proof point encoded as (0, 0) can therefore enter the final aggregation sum through the scalar-one shortcut and affect the MSM or accumulator computation. Practical exploitability depends on the surrounding aggregation and final-decider checks; the advisory does not establish universal acceptance of invalid proofs. This issue is fixed in version 0.2.5.
This page as .md · .json · in your agent: get_signal("CVE-2026-62337")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.