{"id":"CVE-2026-62337","kind":"vulnerability","aliases":["CVE-2026-62337"],"related":[],"title":"SNARK Verifier: point-at-infinity input can corrupt final proof aggregation sum","description":"SNARK Verifier is a generic (S)NARK verifier. Prior to 0.2.5, the Halo 2 aggregation circuit can mishandle proof points encoded as the point at infinity. `EcPointLoader::multi_scalar_multiplication` places a `Value::Assigned(_)` base paired with `Value::Constant(ONE)` into its unscaled variable-base list and passes it directly to `sum_with_const`. The default shim delegates to halo2-lib `EccChip::sum`, whose incomplete affine addition assumes nonidentity input points. A prover-controlled proof point encoded as `(0, 0)` can therefore enter the final aggregation sum through the scalar-one shortcut and affect the MSM or accumulator computation. Practical exploitability depends on the surrounding aggregation and final-decider checks; the advisory does not establish universal acceptance of invalid proofs. This issue is fixed in version 0.2.5.","summary":"SNARK Verifier is a generic (S)NARK verifier library; before 0.2.5 a prover-supplied proof point encoded as (0, 0) can enter the Halo 2 aggregation sum through a scalar-one shortcut. An attacker who controls a proof may influence the multi-scalar multiplication or accumulator result, though the advisory does not establish that invalid proofs are universally accepted.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["halo2","package","rust","snark-verifier","zk-proofs"],"not_affected_if":["no-halo2-aggregation","trusted-prover-only"],"how_to_check":"- Check the installed `snark-verifier` crate version in `Cargo.lock` and confirm whether it is below `0.2.5`.\n- Look for uses of the Halo 2 aggregation circuit or `EcPointLoader::multi_scalar_multiplication` in your verifier code.","fix":"- `snark-verifier` `0.2.5`","status":"open","published_at":"2026-10-30T20:17:12+00:00","first_seen_at":"2026-10-30T20:25:39+00:00","triaged_at":"2026-10-30T20:26:43+00:00","updated_at":"2026-10-30T20:26:43+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T20:26:43Z","model":"claude-haiku-5-5","output":{"fix":"- `snark-verifier` `0.2.5`","reach":"unknown","title":"SNARK Verifier: point-at-infinity input can corrupt final proof aggregation sum","impact":"medium","summary":"SNARK Verifier is a generic (S)NARK verifier library; before 0.2.5 a prover-supplied proof point encoded as (0, 0) can enter the Halo 2 aggregation sum through a scalar-one shortcut. An attacker who controls a proof may influence the multi-scalar multiplication or accumulator result, though the advisory does not establish that invalid proofs are universally accepted.","audience":"developers","category":"package","nicknames":[],"who_cares":["rust","zk-proofs","halo2","snark-verifier"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Final aggregation check may accept a manipulated proof point","analyst_note":"","how_to_check":"- Check the installed `snark-verifier` crate version in `Cargo.lock` and confirm whether it is below `0.2.5`.\n- Look for uses of the Halo 2 aggregation circuit or `EcPointLoader::multi_scalar_multiplication` in your verifier code.","plain_action":"","needs_analyst":false,"not_affected_if":["no-halo2-aggregation","trusted-prover-only"],"who_is_affected":"Teams that use the SNARK Verifier crate to verify Halo 2 aggregation proofs, especially where proof points come from an untrusted prover. Systems that do not run the Halo 2 aggregation circuit or do not verify untrusted proofs with this crate are less exposed. The advisory notes that practical exploitability depends on the surrounding aggregation and final-decider checks.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000754,"input_tokens":4326,"output_tokens":642,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-62337':16A,19A '0':48B,49B,172C,173C '0.2.5':39B,101C,222C '2':54B,104C 'accept':90B,212C 'accumul':77B,192C 'addit':159C 'advisori':81B,207C 'affect':188C 'affin':158C 'aggreg':12A,55B,105C,179C,200C 'assign':124C 'assum':160C 'attack':64B 'base':125C,136C 'check':205C 'circuit':106C 'comput':193C 'const':145C 'constant':129C 'control':66B,167C 'corrupt':9A 'cve':14A,17A 'decid':204C 'default':147C 'deleg':149C 'depend':196C 'direct':141C 'eccchip':154C 'ecpointload':117C 'encod':46B,111C,170C 'enter':51B,176C 'establish':84B,210C 'exploit':195C 'final':10A,178C,203C 'final-decid':202C 'fix':219C 'generic':33B,95C 'halo':53B,103C 'halo2':20B,152C 'halo2-lib':151C 'incomplet':157C 'infin':6A,116C 'influenc':70B 'input':7A,162C 'invalid':86B,214C 'issu':217C 'lib':153C 'librari':37B 'list':137C 'may':69B 'mishandl':108C 'msm':190C 'multi':73B,118C 'multi-scalar':72B 'multipl':75B,120C 'nark':35B,97C 'nonident':161C 'one':61B,130C,185C 'packag':21B 'pair':126C 'pass':139C 'place':121C 'point':4A,45B,110C,114C,163C,169C 'point-at-infin':3A 'practic':194C 'prior':99C 'proof':11A,28B,44B,68B,87B,109C,168C,215C 'prover':42B,166C 'prover-control':165C 'prover-suppli':41B 'result':78B 'rust':22B 'scalar':60B,74B,119C,184C 'scalar-on':59B,183C 'shim':148C 'shortcut':62B,186C 'snark':1A,24B,29B,91C 'snark-verifi':23B 'sum':13A,56B,143C,155C,180C 'suppli':43B 'surround':199C 'therefor':175C 'though':79B 'univers':89B,211C 'unscal':133C 'valu':123C,128C 'variabl':135C 'variable-bas':134C 'verifi':2A,25B,30B,36B,92C,98C 'version':221C 'whose':156C 'zk':27B 'zk-proof':26B","nicknames":[],"mitigations":[],"who_affected":"Teams that use the SNARK Verifier crate to verify Halo 2 aggregation proofs, especially where proof points come from an untrusted prover. Systems that do not run the Halo 2 aggregation circuit or do not verify untrusted proofs with this crate are less exposed. The advisory notes that practical exploitability depends on the surrounding aggregation and final-decider checks.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T20:17:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62337","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62337","severity":null,"published_at":"2026-10-30T20:17:12+00:00","modified_at":"2026-10-30T20:17:12+00:00","first_seen_at":"2026-10-30T20:25:39+00:00","fetched_at":"2026-10-30T20:25:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}