CVE-2025-58157: consensys gnark

csirt@kutim:~/threat-intel/cve/CVE-2025-58157

CVSS 7.5 · High EPSS 0,52%

Kerentanan Uncontrolled Resource Consumption pada consensys gnark. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

gnark is a zero-knowledge proof system framework. In version 0.12.0, there is a potential denial of service vulnerability when computing scalar multiplication is using the fake-GLV algorithm. This is because the algorithm didn't converge quickly enough for some of the inputs. This issue has been patched in version 0.13.0.

Rincian

Terbit di NVD: 29 Agustus 2025
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-400: Uncontrolled Resource Consumption
EPSS (30 hari): 0,52% peluang dieksploitasi; lebih tinggi dari 42,2% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
consensys	gnark	Versi 0.12.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/Consensys/gnark/security/advisories/GHSA-9fvj-xqr2-xwg8 advisory vendor
https://github.com/Consensys/gnark-crypto/commit/56600883e0e9f9b159e9c7000b94e76185ec3d0d patch
https://github.com/Consensys/gnark/commit/68be6cede36e387ab760725beabd3c96cc94e6dc patch
https://github.com/Consensys/gnark/issues/1483 exploit · issue tracking

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.