Every CVE Search/ Get API key

CVE-2024-50354

Out-of-memory during deserialization with crafted inputs

5.5 MediumFix available

gnark is a fast zk-SNARK library that offers a high-level API to design circuits. In gnark 0.11.0 and earlier, deserialization of Groth16 verification keys allocate excessive memory, consuming a lot of resources and triggering a crash with the error fatal error: runtime: out of memory.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.33%Up 0.3 points since Nov 1, 2024
90%50%10%1%

What each source reports

CVE List Score used 5.5

Out-of-memory during deserialization with crafted inputs

gnark is a fast zk-SNARK library that offers a high-level API to design circuits. In gnark 0.11.0 and earlier, deserialization of Groth16 verification keys allocate excessive memory, consuming a lot of resources and triggering a crash with the error fatal error: runtime: out of memory.

Record
CVE-2024-50354
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
EUVDEUVD-2024-3021 5.5

gnark is a fast zk-SNARK library that offers a high-level API to design circuits. In gnark 0.11.0 and earlier, deserialization of Groth16 verification keys allocate excessive memory, consuming a lot of resources and triggering a crash with the error fatal error: runtime: out of memory.

Record
EUVD-2024-3021
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-cph5-3pgr-c82g 6.8

Gnark out-of-memory during deserialization with crafted inputs

Thanks @pventuzelo for reporting.

From the correspondence:

Hi,

We (Fuzzinglabs & Lambdaclass) found that during deserialization of certain files representing a VerifyingKey, an excessive memory allocation is happening consuming a lot of resources and even triggering a crash with the error fatal error: runtime: out of memory.

Please find the details below:

Vulnerability Details

  • Severity: Critical -> DoS
  • Affected Component: Deserialization

Environment

  • Compiler Version: go version go1.22.2 linux/amd64

  • Distro Version: Ubuntu 24.04.1 LTS

  • Additional Environment Details:

    • [github.com/consensys/gnark](http://github.com/consensys/gnark) v0.11.0
    • [github.com/consensys/gnark-crypto](http://github.com/consensys/gnark-crypto) v0.14.1-0.20240909142611-e6b99e74cec1

Steps to Reproduce

You can download the needed files here: https://drive.google.com/drive/folders/1KQ5I3vv4bUllvqbatGappwbAkIcR2NI_?usp=sharing

You have to run

go run gnark_poc.go

in a terminal.

Running the provided code will result in a memory crash or an extremely large memory allocation, which can be observed using the following command:

go tool pprof -web mem.pprof

Root Cause Analysis

The provided code loads a VerifyingKey from old.vk by calling the ReadFrom function. This function is implemented in backend/groth16/bn254/marshal.go within the gnark library.

The provided example uses the elliptic curve BN-254, so the code resides in the backend/groth16/bn254/ repertory. However, the same error exists in other repertories, such as backend/groth16/bls12-377/.

At line 207, a slice is allocated with a length of nbCommitments. This variable is directly extracted from the deserialized file, which, in our case, has a value of 2,327,186,600. This large value may be too big for some configurations, leading to memory allocations of approximately ±1 TB, as observed with pprof.

Detailed Behavior

go run gnark_poc.go

fatal error: runtime: out of memory

runtime stack:
runtime.throw({0x5fe946?, 0x2052ae?})
/usr/lib/go-1.22/src/runtime/panic.go:1023 +0x5c fp=0x7ffd65b321a0 sp=0x7ffd65b32170 pc=0x438a9c
runtime.sysMapOS(0xc000400000, 0x8ab6400000)
/usr/lib/go-1.22/src/runtime/mem_linux.go:167 +0x11b fp=0x7ffd65b321e0 sp=0x7ffd65b321a0 pc=0x418bbb
runtime.sysMap(0xc000400000, 0x8ab6400000, 0x7b19c8?)
/usr/lib/go-1.22/src/runtime/mem.go:155 +0x34 fp=0x7ffd65b32200 sp=0x7ffd65b321e0 pc=0x418634
runtime.(*mheap).grow(0x7a17c0, 0x455b066?)
/usr/lib/go-1.22/src/runtime/mheap.go:1534 +0x236 fp=0x7ffd65b32270 sp=0x7ffd65b32200 pc=0x42b176
runtime.(*mheap).allocSpan(0x7a17c0, 0x455b066, 0x0, 0x1)
/usr/lib/go-1.22/src/runtime/mheap.go:1246 +0x1b0 fp=0x7ffd65b32310 sp=0x7ffd65b32270 pc=0x42a850
runtime.(*mheap).alloc.func1()
/usr/lib/go-1.22/src/runtime/mheap.go:964 +0x5c fp=0x7ffd65b32358 sp=0x7ffd65b32310 pc=0x42a2fc
runtime.systemstack(0x46d79f)
/usr/lib/go-1.22/src/runtime/asm_amd64.s:509 +0x4a fp=0x7ffd65b32368 sp=0x7ffd65b32358 pc=0x46912a

goroutine 1 gp=0xc0000061c0 m=0 mp=0x798ca0 [running]:
runtime.systemstack_switch()
/usr/lib/go-1.22/src/runtime/asm_amd64.s:474 +0x8 fp=0xc000031b68 sp=0xc000031b58 pc=0x4690c8
runtime.(*mheap).alloc(0x5bc040?, 0xc00012bb08?, 0xa0?)
/usr/lib/go-1.22/src/runtime/mheap.go:958…
Record
GHSA-cph5-3pgr-c82g
CVSS 4.0
6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
NVD 5.5

gnark is a fast zk-SNARK library that offers a high-level API to design circuits. In gnark 0.11.0 and earlier, deserialization of Groth16 verification keys allocate excessive memory, consuming a lot of resources and triggering a crash with the error fatal error: runtime: out of memory.

Record
CVE-2024-50354
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
OSV 5.5

Out-of-memory during deserialization with crafted inputs

gnark is a fast zk-SNARK library that offers a high-level API to design circuits. In gnark 0.11.0 and earlier, deserialization of Groth16 verification keys allocate excessive memory, consuming a lot of resources and triggering a crash with the error fatal error: runtime: out of memory.

Record
CVE-2024-50354
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
OSVGHSA-cph5-3pgr-c82g 6.8

Gnark out-of-memory during deserialization with crafted inputs

Thanks @pventuzelo for reporting.

From the correspondence:

Hi,

We (Fuzzinglabs & Lambdaclass) found that during deserialization of certain files representing a VerifyingKey, an excessive memory allocation is happening consuming a lot of resources and even triggering a crash with the error fatal error: runtime: out of memory.

Please find the details below:

Vulnerability Details

  • Severity: Critical -> DoS
  • Affected Component: Deserialization

Environment

  • Compiler Version: go version go1.22.2 linux/amd64

  • Distro Version: Ubuntu 24.04.1 LTS

  • Additional Environment Details:

    • [github.com/consensys/gnark](http://github.com/consensys/gnark) v0.11.0
    • [github.com/consensys/gnark-crypto](http://github.com/consensys/gnark-crypto) v0.14.1-0.20240909142611-e6b99e74cec1

Steps to Reproduce

You can download the needed files here: https://drive.google.com/drive/folders/1KQ5I3vv4bUllvqbatGappwbAkIcR2NI_?usp=sharing

You have to run

go run gnark_poc.go

in a terminal.

Running the provided code will result in a memory crash or an extremely large memory allocation, which can be observed using the following command:

go tool pprof -web mem.pprof

Root Cause Analysis

The provided code loads a VerifyingKey from old.vk by calling the ReadFrom function. This function is implemented in backend/groth16/bn254/marshal.go within the gnark library.

The provided example uses the elliptic curve BN-254, so the code resides in the backend/groth16/bn254/ repertory. However, the same error exists in other repertories, such as backend/groth16/bls12-377/.

At line 207, a slice is allocated with a length of nbCommitments. This variable is directly extracted from the deserialized file, which, in our case, has a value of 2,327,186,600. This large value may be too big for some configurations, leading to memory allocations of approximately ±1 TB, as observed with pprof.

Detailed Behavior

go run gnark_poc.go

fatal error: runtime: out of memory

runtime stack:
runtime.throw({0x5fe946?, 0x2052ae?})
/usr/lib/go-1.22/src/runtime/panic.go:1023 +0x5c fp=0x7ffd65b321a0 sp=0x7ffd65b32170 pc=0x438a9c
runtime.sysMapOS(0xc000400000, 0x8ab6400000)
/usr/lib/go-1.22/src/runtime/mem_linux.go:167 +0x11b fp=0x7ffd65b321e0 sp=0x7ffd65b321a0 pc=0x418bbb
runtime.sysMap(0xc000400000, 0x8ab6400000, 0x7b19c8?)
/usr/lib/go-1.22/src/runtime/mem.go:155 +0x34 fp=0x7ffd65b32200 sp=0x7ffd65b321e0 pc=0x418634
runtime.(*mheap).grow(0x7a17c0, 0x455b066?)
/usr/lib/go-1.22/src/runtime/mheap.go:1534 +0x236 fp=0x7ffd65b32270 sp=0x7ffd65b32200 pc=0x42b176
runtime.(*mheap).allocSpan(0x7a17c0, 0x455b066, 0x0, 0x1)
/usr/lib/go-1.22/src/runtime/mheap.go:1246 +0x1b0 fp=0x7ffd65b32310 sp=0x7ffd65b32270 pc=0x42a850
runtime.(*mheap).alloc.func1()
/usr/lib/go-1.22/src/runtime/mheap.go:964 +0x5c fp=0x7ffd65b32358 sp=0x7ffd65b32310 pc=0x42a2fc
runtime.systemstack(0x46d79f)
/usr/lib/go-1.22/src/runtime/asm_amd64.s:509 +0x4a fp=0x7ffd65b32368 sp=0x7ffd65b32358 pc=0x46912a

goroutine 1 gp=0xc0000061c0 m=0 mp=0x798ca0 [running]:
runtime.systemstack_switch()
/usr/lib/go-1.22/src/runtime/asm_amd64.s:474 +0x8 fp=0xc000031b68 sp=0xc000031b58 pc=0x4690c8
runtime.(*mheap).alloc(0x5bc040?, 0xc00012bb08?, 0xa0?)
/usr/lib/go-1.22/src/runtime/mheap.go:958…
Record
GHSA-cph5-3pgr-c82g
CVSS 4.0
6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
Show 5 moreShow less
OSVGO-2024-3244 No score

Gnark out-of-memory during deserialization with crafted inputs in github.com/consensys/gnark

Gnark out-of-memory during deserialization with crafted inputs in github.com/consensys/gnark

Record
GO-2024-3244
Updated
2026-11-02
OSVopenSUSE-SU-2024:0350-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

  • Update to version 0.0.20241104T154416 2024-11-04T15:44:16Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2024-3233 CVE-2024-46872 GHSA-762g-9p7f-mrww
    • GO-2024-3234 CVE-2024-47401 GHSA-762v-rq7q-ff97
    • GO-2024-3235 CVE-2024-50052 GHSA-g376-m3h3-mj4r
    • GO-2024-3237 CVE-2024-0133 GHSA-f748-7hpg-88ch
    • GO-2024-3239 CVE-2024-0132 GHSA-mjjw-553x-87pq
    • GO-2024-3240 CVE-2024-10452 GHSA-66c4-2g2v-54qw
    • GO-2024-3241 CVE-2024-10006 GHSA-5c4w-8hhh-3c3h
    • GO-2024-3242 CVE-2024-10086 GHSA-99wr-c2px-grmh
    • GO-2024-3243 CVE-2024-10005 GHSA-chgm-7r52-whjj

  • Update to version 0.0.20241101T215616 2024-11-01T21:56:16Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2024-3244 CVE-2024-50354 GHSA-cph5-3pgr-c82g
    • GO-2024-3245 CVE-2024-39720
    • GO-2024-3246 CVE-2024-8185 GHSA-g233-2p4r-3q7v

  • Update to version 0.0.20241030T212825 2024-10-30T21:28:25Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2024-3230 CVE-2024-48921 GHSA-qjvc-p88j-j9rm
    • GO-2024-3232 CVE-2024-10241 GHSA-6mvp-gh77-7vwh

  • Update to version 0.0.20241030T160108 2024-10-30T16:01:08Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2024-3226 CVE-2024-47827 GHSA-ghjw-32xw-ffwr
    • GO-2024-3227 CVE-2024-10214 GHSA-hm57-h27x-599c
    • GO-2024-3228 GHSA-wcx9-ccpj-hx3c

  • Packaging improvments:

    • Backfill CVE aliases in recent changelog entries

  • Update to version 0.0.20241028T152002 2024-10-28T15:20:02Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2024-3207 GHSA-p5wf-cmr4-xrwr
    • GO-2024-3208 CVE-2024-47825 GHSA-3wwx-63fv-pfq6
    • GO-2024-3210 CVE-2024-8901
    • GO-2024-3211 CVE-2024-50312
    • GO-2024-3212 GHSA-rjfv-pjvx-mjgv
    • GO-2024-3213 CVE-2024-49380
    • GO-2024-3214 CVE-2024-49381
    • GO-2024-3215 CVE-2024-9264 GHSA-q99m-qcv4-fpm7
    • GO-2024-3216 CVE-2024-49753 GHSA-6cf5-w9h3-4rqv
    • GO-2024-3217 CVE-2024-49757 GHSA-3rmw-76m6-4gjc
    • GO-2024-3219 GHSA-7h65-4p22-39j6
    • GO-2024-3220 CVE-2023-32197 GHSA-7h8m-pvw3-5gh4
    • GO-2024-3221 CVE-2024-22036 GHSA-h99m-6755-rgwc
    • GO-2024-3222 GHSA-x7xj-jvwp-97rv
    • GO-2024-3223 CVE-2022-45157 GHSA-xj7w-r753-vj8v
    • GO-2024-3224 CVE-2024-39223 GHSA-8wxx-35qc-vp6r

  • Update to version 0.0.20241017T153730 date 2024-10-17T15:37:30Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2024-3189 CVE-2024-38365 GHSA-27vh-h6mc-q6g8
    • GO-2024-3203 CVE-2024-9486
    • GO-2024-3204 CVE-2024-9594

    Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2024-3189 CVE-2024-38365 GHSA-27vh-h6mc-q6g8
    • GO-2024-3196 CVE-2024-47877 GHSA-8rm2-93mq-jqhc
    • GO-2024-3199 GHSA-vv6c-69r6-chg9
    • GO-2024-3200 CVE-2024-48909 GHSA-3c32-4hq9-6wgj
    • GO-2024-3201 CVE-2023-22644 Go CVE Numbering Authority IDs added or updated with aliases:
    • GO-2024-3166 CVE-2024-47534 GHSA-4f8r-qqr9-fq8j
    • GO-2024-3171 CVE-2024-9341 GHSA-mc76-5925-c5p6 Go CVE Numbering Authority IDs added or updated with aliases:
    • GO-2024-3161 CVE-2024-22030 GHSA-h4h5-9833-v2p4
    • GO-2024-3162 CVE-2024-7594 GHSA-jg74-mwgw-v6x3
    • GO-2024-3163 CVE-2024-47182
    • GO-2024-3164 CVE-2024-47003 GHSA-59hf-mpf8-pqjh
    • GO-2024-3166 CVE-2024-47534 GHSA-4f8r-qqr9-fq8j
    • GO-2024-3167 CVE-2024-9355 GHSA-3h3x-2hwv-hr52
    • GO-2024-3168 CVE-2024-8975 GHSA-chqx-36rm-rf8h
    • GO-2024-3169 CVE-2024-9407 GHSA-fhqq-8f65-5xfc
    • GO-2024-3170 CVE-2024-8996 GHSA-m5gv-m5f9-wgv4
    • GO-2024-3172 CVE-2024-33662 GHSA-9mjw-79r6-c9m8
    • GO-2024-3173 CVE-2024-7558 GHSA-mh98-763h-m9v4
    • GO-2024-3174 CVE-2024-8037 GHSA-8v4w-f4r9-7h6x
    • GO-2024-3175 CVE-2024-8038 GHSA-xwgj-vpm9-q2rq
    • GO-2024-3179 CVE-2024-47616 GHSA-r7rh-jww5-5fjr
    • GO-2024-3181 CVE-2024-9313 GHSA-x5q3-c8rm-w787
    • GO-2024-3182 GHSA-wpr2-j6gr-pjw9 *…
Record
openSUSE-SU-2024:0350-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:14452-1 No score

govulncheck-vulndb-0.0.20241101T215616-1.1 on GA media

These are all security issues fixed in the govulncheck-vulndb-0.0.20241101T215616-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14452-1
Updated
2026-11-02
OSVSUSE-SU-2024:3950-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

  • Update to version 0.0.20241104T154416 2024-11-04T15:44:16Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2024-3233 CVE-2024-46872 GHSA-762g-9p7f-mrww
    • GO-2024-3234 CVE-2024-47401 GHSA-762v-rq7q-ff97
    • GO-2024-3235 CVE-2024-50052 GHSA-g376-m3h3-mj4r
    • GO-2024-3237 CVE-2024-0133 GHSA-f748-7hpg-88ch
    • GO-2024-3239 CVE-2024-0132 GHSA-mjjw-553x-87pq
    • GO-2024-3240 CVE-2024-10452 GHSA-66c4-2g2v-54qw
    • GO-2024-3241 CVE-2024-10006 GHSA-5c4w-8hhh-3c3h
    • GO-2024-3242 CVE-2024-10086 GHSA-99wr-c2px-grmh
    • GO-2024-3243 CVE-2024-10005 GHSA-chgm-7r52-whjj

  • Update to version 0.0.20241101T215616 2024-11-01T21:56:16Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2024-3244 CVE-2024-50354 GHSA-cph5-3pgr-c82g
    • GO-2024-3245 CVE-2024-39720
    • GO-2024-3246 CVE-2024-8185 GHSA-g233-2p4r-3q7v
Record
SUSE-SU-2024:3950-1
Updated
2026-11-02
OSVSUSE-SU-2025:0429-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

  • Update to version 0.0.20250207T224745 2025-02-07T22:47:45Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2025-3456 CVE-2025-24786 GHSA-9r4c-jwx3-3j76
    • GO-2025-3457 CVE-2025-24787 GHSA-c7w4-9wv8-7x7c
    • GO-2025-3458 CVE-2025-24366 GHSA-vj7w-3m8c-6vpx

  • Update to version 0.0.20250206T175003 2025-02-06T17:50:03Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2023-1867 CVE-2022-47930 GHSA-c58h-qv6g-fw74
    • GO-2024-3244 CVE-2024-50354 GHSA-cph5-3pgr-c82g

  • Update to version 0.0.20250206T165438 2025-02-06T16:54:38Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2025-3428 CVE-2025-22867
    • GO-2025-3447 CVE-2025-22866

  • Update to version 0.0.20250205T232745 2025-02-05T23:27:45Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2025-3408
    • GO-2025-3448 GHSA-23qp-3c2m-xx6w
    • GO-2025-3449 GHSA-mx2j-7cmv-353c
    • GO-2025-3450 GHSA-w7wm-2425-7p2h
    • GO-2025-3454 GHSA-mj4v-hp69-27x5
    • GO-2025-3455 GHSA-vqv5-385r-2hf8

  • Update to version 0.0.20250205T003520 2025-02-05T00:35:20Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2025-3451

  • Update to version 0.0.20250204T220613 2025-02-04T22:06:13Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2025-3431 CVE-2025-24884 GHSA-hcr5-wv4p-h2g2
    • GO-2025-3433 CVE-2025-23216 GHSA-47g2-qmh2-749v
    • GO-2025-3434 CVE-2025-24376 GHSA-fc89-jghx-8pvg
    • GO-2025-3435 CVE-2025-24784 GHSA-756x-m4mj-q96c
    • GO-2025-3436 CVE-2025-24883 GHSA-q26p-9cq4-7fc2
    • GO-2025-3437 GHSA-274v-mgcv-cm8j
    • GO-2025-3438 CVE-2024-11741 GHSA-wxcc-2f3q-4h58
    • GO-2025-3442 CVE-2025-24371 GHSA-22qq-3xwm-r5x4
    • GO-2025-3443 GHSA-r3r4-g7hq-pq4f
    • GO-2025-3444 CVE-2024-35177
    • GO-2025-3445 CVE-2024-47770

  • Use standard RPM macros to unpack the source and populate a working directory. Fixes build with RPM 4.20.

  • Update to version 0.0.20250130T185858 2025-01-30T18:58:58Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2024-2842 CVE-2024-3727 GHSA-6wvf-f2vw-3425
    • GO-2024-3181 CVE-2024-9313 GHSA-x5q3-c8rm-w787
    • GO-2024-3188 CVE-2024-9312 GHSA-4gfw-wf7c-w6g2
    • GO-2025-3372 CVE-2024-45339 GHSA-6wxm-mpqj-6jpf
    • GO-2025-3373 CVE-2024-45341
    • GO-2025-3383 CVE-2024-45340
    • GO-2025-3408
    • GO-2025-3412 CVE-2024-10846 GHSA-36gq-35j3-p9r9
    • GO-2025-3420 CVE-2024-45336
    • GO-2025-3421 CVE-2025-22865
    • GO-2025-3424 CVE-2025-24369
    • GO-2025-3426 CVE-2025-0750 GHSA-hp5j-2585-qx6g
    • GO-2025-3427 CVE-2024-13484 GHSA-58fx-7v9q-3g56
Record
SUSE-SU-2025:0429-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/consensys/gnark
Go
 through 0.11.0
0.11.1
github.com/consensys/gnark
Go
 before 0.11.1
0.11.1
github.com/consensys/gnark
Go
 before 0.12.0
0.12.0
govulncheck-vulndb
SUSE:Linux Enterprise Module for Package Hub 15 SP5
From an advisory covering 12 CVEs
 before 0.0.20241104T154416-150000.1.12.1
0.0.20241104T154416-150000.1.12.1
govulncheck-vulndb
SUSE:Linux Enterprise Module for Package Hub 15 SP6
From an advisory covering 12 CVEs
 before 0.0.20241104T154416-150000.1.12.1
0.0.20241104T154416-150000.1.12.1
govulncheck-vulndb
openSUSE:Leap 15.5
From an advisory covering 12 CVEs
 before 0.0.20241104T154416-150000.1.12.1
0.0.20241104T154416-150000.1.12.1
govulncheck-vulndb
openSUSE:Leap 15.6
From an advisory covering 12 CVEs
 before 0.0.20241104T154416-150000.1.12.1
0.0.20241104T154416-150000.1.12.1
govulncheck-vulndb
SUSE:Linux Enterprise Module for Package Hub 15 SP6
From an advisory covering 28 CVEs
 before 0.0.20250207T224745-150000.1.32.1
0.0.20250207T224745-150000.1.32.1
govulncheck-vulndb
openSUSE:Leap 15.6
From an advisory covering 28 CVEs
 before 0.0.20250207T224745-150000.1.32.1
0.0.20250207T224745-150000.1.32.1
govulncheck-vulndb
SUSE:Package Hub 12
From an advisory covering 56 CVEs
 before 0.0.20241104T154416-5.1
0.0.20241104T154416-5.1
govulncheck-vulndb
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
 before 0.0.20241101T215616-1.1
0.0.20241101T215616-1.1

History

History
RecordedChangedSources
affected, facts
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-50354 is a medium vulnerability (CVSS 5.5) in Consensys Gnark, published October 31, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 25th percentile. Fixed in github.com/consensys/gnark 0.11.1.

References

Show 86 moreShow less
This page doesn't list everything

Left out here: the rest of 3 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open