{"id":"CVE-2024-50354","aliases":["EUVD-2024-3021","GHSA-cph5-3pgr-c82g","GO-2024-3244","SUSE-SU-2024:3950-1","SUSE-SU-2025:0429-1","openSUSE-SU-2024:0350-1","openSUSE-SU-2024:14452-1"],"status":"published","title":"Out-of-memory during deserialization with crafted inputs","description":"gnark is a fast zk-SNARK library that offers a high-level API to design circuits. In gnark 0.11.0 and earlier, deserialization of Groth16 verification keys allocate excessive memory, consuming a lot of resources and triggering a crash with the error fatal error: runtime: out of memory.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00325,"percentile":0.25889,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2024-10-31T15:59:30Z","modified":"2026-10-28T02:30:41Z","fixes":[{"ecosystem":"Go","package":"github.com/consensys/gnark","fixed_in":["0.11.1","0.12.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/consensys/gnark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.11.0"},{"fixed":"0.11.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/consensys/gnark","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.11.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/consensys/gnark","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.12.0"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20241104T154416-150000.1.12.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20241104T154416-150000.1.12.1"}]}],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20241104T154416-150000.1.12.1"}]}],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20241104T154416-150000.1.12.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250207T224745-150000.1.32.1"}]}],"bundled":28},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250207T224745-150000.1.32.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20241104T154416-5.1"}]}],"bundled":56},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20241101T215616-1.1"}]}],"bundled":3}],"products":[{"vendor":"consensys","product":"gnark"}],"references":[{"url":"https://github.com/Consensys/gnark/security/advisories/GHSA-cph5-3pgr-c82g","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/Consensys/gnark/pull/1307","tags":["x_refsource_MISC","Issue Tracking","Patch","fix","web"]},{"url":"https://github.com/Consensys/gnark/commit/47ae846339add2bdf9983e499342bfdfe195191d","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50354","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-cph5-3pgr-c82g","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50354.json","tags":["advisory"]},{"url":"https://github.com/Consensys/gnark","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243950-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-0132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-0133","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-10005","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-10006","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-10086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-10452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50354","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8185","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250429-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2022-47930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-10846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-11741","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-13484","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-3727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45336","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45340","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45341","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47770","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22866","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22867","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24366","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24369","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24371","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24787","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24884","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2022-45157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-22644","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-32197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-10214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-10241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22030","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-33662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38365","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39223","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47003","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47067","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47534","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47827","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-48909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-48921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49757","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-7558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-7594","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8901","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8975","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9264","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9341","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9355","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9486","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9594","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9675","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WQQ5UEFZXC7VPUP3LYNW742JYGOX2KVH/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-50354","title":"Out-of-memory during deserialization with crafted inputs","description":"gnark is a fast zk-SNARK library that offers a high-level API to design circuits. In gnark 0.11.0 and earlier, deserialization of Groth16 verification keys allocate excessive memory, consuming a lot of resources and triggering a crash with the error fatal error: runtime: out of memory.","status":"published","published":"2024-10-31T15:59:30.063Z","modified":"2024-10-31T16:53:21.298Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:34:22.153872Z"}],"euvd":[{"id":"EUVD-2024-3021","description":"gnark is a fast zk-SNARK library that offers a high-level API to design circuits. In gnark 0.11.0 and earlier, deserialization of Groth16 verification keys allocate excessive memory, consuming a lot of resources and triggering a crash with the error fatal error: runtime: out of memory.","status":"published","published":"2024-10-31T15:59:30Z","modified":"2024-10-31T16:53:21Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T00:05:13.001555Z"}],"ghsa":[{"id":"GHSA-cph5-3pgr-c82g","title":"Gnark out-of-memory during deserialization with crafted inputs","description":"Thanks @pventuzelo for reporting.\n\nFrom the correspondence:\n\n\u003e Hi,\n\u003e \n\u003e We (Fuzzinglabs \u0026 Lambdaclass) found that during deserialization of certain files representing a `VerifyingKey`, an excessive memory allocation is happening consuming a lot of resources and even triggering a crash with the error `fatal error: runtime: out of memory`.\n\u003e \n\u003e Please find the details below:\n\u003e \n\u003e ## Vulnerability Details\n\u003e \n\u003e - **Severity:** Critical -\u003e DoS\n\u003e - **Affected Component:** Deserialization\n\u003e \n\u003e ## Environment\n\u003e \n\u003e - **Compiler Version:** go version go1.22.2 linux/amd64\n\u003e - **Distro Version:** Ubuntu 24.04.1 LTS\n\u003e \n\u003e - **Additional Environment Details:**\n\u003e   - `[github.com/consensys/gnark](http://github.com/consensys/gnark) v0.11.0`\n\u003e   - `[github.com/consensys/gnark-crypto](http://github.com/consensys/gnark-crypto) v0.14.1-0.20240909142611-e6b99e74cec1`\n\u003e \n\u003e ## Steps to Reproduce\n\u003e \n\u003e You can download the needed files here: https://drive.google.com/drive/folders/1KQ5I3vv4bUllvqbatGappwbAkIcR2NI_?usp=sharing\n\u003e \n\u003e You have to run\n\u003e \n\u003e ```shell\n\u003e go run gnark_poc.go\n\u003e ```\n\u003e \n\u003e in a terminal.\n\u003e \n\u003e Running the provided code will result in a memory crash or an extremely large memory allocation, which can be observed using the following command:\n\u003e \n\u003e ```shell\n\u003e go tool pprof -web mem.pprof\n\u003e ```\n\u003e \n\u003e ## Root Cause Analysis\n\u003e \n\u003e The provided code loads a `VerifyingKey` from `old.vk` by calling the `ReadFrom` function. This function is implemented in [backend/groth16/bn254/marshal.go](https://github.com/Consensys/gnark/blob/ca8e1568f47ae6b717eda0a6734d87645edaecf7/backend/groth16/bn254/marshal.go#L174C2-L174C25) within the [gnark](https://github.com/Consensys/gnark) library.\n\u003e \n\u003e The provided example uses the elliptic curve BN-254, so the code resides in the [backend/groth16/bn254/](https://github.com/Consensys/gnark/blob/ca8e1568f47ae6b717eda0a6734d87645edaecf7/backend/groth16/bn254/) repertory. However, the same error exists in other repertories, such as [backend/groth16/bls12-377/](https://github.com/Consensys/gnark/blob/ca8e1568f47ae6b717eda0a6734d87645edaecf7/backend/groth16/bls12-377/).\n\u003e \n\u003e At [line 207](https://github.com/Consensys/gnark/blob/ca8e1568f47ae6b717eda0a6734d87645edaecf7/backend/groth16/bn254/marshal.go#L207), a slice is allocated with a length of `nbCommitments`. This variable is directly extracted from the deserialized file, which, in our case, has a value of `2,327,186,600`. This large value may be too big for some configurations, leading to memory allocations of approximately ±1 TB, as observed with `pprof`.\n\u003e \n\u003e ## Detailed Behavior\n\u003e \n\u003e ```shell\n\u003e go run gnark_poc.go\n\u003e ```\n\u003e \n\u003e ```\n\u003e fatal error: runtime: out of memory\n\u003e \n\u003e runtime stack:\n\u003e runtime.throw({0x5fe946?, 0x2052ae?})\n\u003e /usr/lib/go-1.22/src/runtime/panic.go:1023 +0x5c fp=0x7ffd65b321a0 sp=0x7ffd65b32170 pc=0x438a9c\n\u003e runtime.sysMapOS(0xc000400000, 0x8ab6400000)\n\u003e /usr/lib/go-1.22/src/runtime/mem_linux.go:167 +0x11b fp=0x7ffd65b321e0 sp=0x7ffd65b321a0 pc=0x418bbb\n\u003e runtime.sysMap(0xc000400000, 0x8ab6400000, 0x7b19c8?)\n\u003e /usr/lib/go-1.22/src/runtime/mem.go:155 +0x34 fp=0x7ffd65b32200 sp=0x7ffd65b321e0 pc=0x418634\n\u003e runtime.(*mheap).grow(0x7a17c0, 0x455b066?)\n\u003e /usr/lib/go-1.22/src/runtime/mheap.go:1534 +0x236 fp=0x7ffd65b32270 sp=0x7ffd65b32200 pc=0x42b176\n\u003e runtime.(*mheap).allocSpan(0x7a17c0, 0x455b066, 0x0, 0x1)\n\u003e /usr/lib/go-1.22/src/runtime/mheap.go:1246 +0x1b0 fp=0x7ffd65b32310 sp=0x7ffd65b32270 pc=0x42a850\n\u003e runtime.(*mheap).alloc.func1()\n\u003e /usr/lib/go-1.22/src/runtime/mheap.go:964 +0x5c fp=0x7ffd65b32358 sp=0x7ffd65b32310 pc=0x42a2fc\n\u003e runtime.systemstack(0x46d79f)\n\u003e /usr/lib/go-1.22/src/runtime/asm_amd64.s:509 +0x4a fp=0x7ffd65b32368 sp=0x7ffd65b32358 pc=0x46912a\n\u003e \n\u003e goroutine 1 gp=0xc0000061c0 m=0 mp=0x798ca0 [running]:\n\u003e runtime.systemstack_switch()\n\u003e /usr/lib/go-1.22/src/runtime/asm_amd64.s:474 +0x8 fp=0xc000031b68 sp=0xc000031b58 pc=0x4690c8\n\u003e runtime.(*mheap).alloc(0x5bc040?, 0xc00012bb08?, 0xa0?)\n\u003e /usr/lib/go-1.22/src/runtime/mheap.go:958 +0x5b fp=0xc000031bb0 sp=0xc000031b68 pc=0x42a25b\n\u003e runtime.(*mcache).allocLarge(0xc000126510?, 0x8ab60ca800, 0x1)\n\u003e /usr/lib/go-1.22/src/runtime/mcache.go:234 +0x87 fp=0xc000031c00 sp=0xc000031bb0 pc=0x4176e7\n\u003e runtime.mallocgc(0x8ab60ca800, 0x5d92a0, 0x1)\n\u003e /usr/lib/go-1.22/src/runtime/malloc.go:1165 +0x597 fp=0xc000031c88 sp=0xc000031c00 pc=0x40ef97\n\u003e runtime.makeslice(0xc00011c180?, 0x0?, 0x2?)\n\u003e /usr/lib/go-1.22/src/runtime/slice.go:107 +0x49 fp=0xc000031cb0 sp=0xc000031c88 pc=0x4500c9\n\u003e [github.com/consensys/gnark/backend/groth16/bn254.(*VerifyingKey).readFrom(0xc0001b7088](http://github.com/consensys/gnark/backend/groth16/bn254.(*VerifyingKey).readFrom(0xc0001b7088), {0x6598a0, 0xc00011dc50}, 0x0)\n\u003e /home/raunan/go/pkg/mod/[github.com/!ronan!thoraval/gnark@v0.0.0-20241007163125-4c0a7511c3d1/backend/groth16/bn254/marshal.go:214](http://github.com/!ronan!thoraval/gnark@v0.0.0-20241007163125-4c0a7511c3d1/backend/groth16/bn254/marshal.go:214) +0x765 fp=0xc000031ea8 sp=0xc000031cb0 pc=0x59b205\n\u003e [github.com/consensys/gnark/backend/groth16/bn254.(*VerifyingKey).ReadFrom(0x100469020](http://github.com/consensys/gnark/backend/groth16/bn254.(*VerifyingKey).ReadFrom(0x100469020)?, {0x6598a0?, 0xc00011dc50?})\n\u003e /home/raunan/go/pkg/mod/[github.com/!ronan!thoraval/gnark@v0.0.0-20241007163125-4c0a7511c3d1/backend/groth16/bn254/marshal.go:166](http://github.com/!ronan!thoraval/gnark@v0.0.0-20241007163125-4c0a7511c3d1/backend/groth16/bn254/marshal.go:166) +0x1f fp=0xc000031ed8 sp=0xc000031ea8 pc=0x59aa5f\n\u003e main.main()\n\u003e /home/raunan/gnark_poc/gnark_poc/gnark_poc.go:19 +0xba fp=0xc000031f50 sp=0xc000031ed8 pc=0x5addda\n\u003e runtime.main()\n\u003e /usr/lib/go-1.22/src/runtime/proc.go:271 +0x29d fp=0xc000031fe0 sp=0xc000031f50 pc=0x43b55d\n\u003e runtime.goexit({})\n\u003e /usr/lib/go-1.22/src/runtime/asm_amd64.s:1695 +0x1 fp=0xc000031fe8 sp=0xc000031fe0 pc=0x46b0e1\n\u003e \n\u003e goroutine 2 gp=0xc000006c40 m=nil [force gc (idle)]:\n\u003e runtime.gopark(0x0?, 0x0?, 0x0?, 0x0?, 0x0?)\n\u003e /usr/lib/go-1.22/src/runtime/proc.go:402 +0xce fp=0xc000074fa8 sp=0xc000074f88 pc=0x43b98e\n\u003e runtime.goparkunlock(...)\n\u003e /usr/lib/go-1.22/src/runtime/proc.go:408\n\u003e runtime.forcegchelper()\n\u003e /usr/lib/go-1.22/src/runtime/proc.go:326 +0xb3 fp=0xc000074fe0 sp=0xc000074fa8 pc=0x43b813\n\u003e runtime.goexit({})\n\u003e /usr/lib/go-1.22/src/runtime/asm_amd64.s:1695 +0x1 fp=0xc000074fe8 sp=0xc000074fe0 pc=0x46b0e1\n\u003e created by runtime.init.6 in goroutine 1\n\u003e /usr/lib/go-1.22/src/runtime/proc.go:314 +0x1a\n\u003e \n\u003e goroutine 3 gp=0xc000007180 m=nil [GC sweep wait]:\n\u003e runtime.gopark(0x0?, 0x0?, 0x0?, 0x0?, 0x0?)\n\u003e /usr/lib/go-1.22/src/runtime/proc.go:402 +0xce fp=0xc000075780 sp=0xc000075760 pc=0x43b98e\n\u003e runtime.goparkunlock(...)\n\u003e /usr/lib/go-1.22/src/runtime/proc.go:408\n\u003e runtime.bgsweep(0xc0000240e0)\n\u003e /usr/lib/go-1.22/src/runtime/mgcsweep.go:278 +0x94 fp=0xc0000757c8 sp=0xc000075780 pc=0x426cf4\n\u003e runtime.gcenable.gowrap1()\n\u003e /usr/lib/go-1.22/src/runtime/mgc.go:203 +0x25 fp=0xc0000757e0 sp=0xc0000757c8 pc=0x41b845\n\u003e runtime.goexit({})\n\u003e /usr/lib/go-1.22/src/runtime/asm_amd64.s:1695 +0x1 fp=0xc0000757e8 sp=0xc0000757e0 pc=0x46b0e1\n\u003e created by runtime.gcenable in goroutine 1\n\u003e /usr/lib/go-1.22/src/runtime/mgc.go:203 +0x66\n\u003e \n\u003e goroutine 4 gp=0xc000007340 m=nil [GC scavenge wait]:\n\u003e runtime.gopark(0xc0000240e0?, 0x657100?, 0x1?, 0x0?, 0xc000007340?)\n\u003e /usr/lib/go-1.22/src/runtime/proc.go:402 +0xce fp=0xc000075f78 sp=0xc000075f58 pc=0x43b98e\n\u003e runtime.goparkunlock(...)\n\u003e /usr/lib/go-1.22/src/runtime/proc.go:408\n\u003e runtime.(*scavengerState).park(0x797520)\n\u003e /usr/lib/go-1.22/src/runtime/mgcscavenge.go:425 +0x49 fp=0xc000075fa8 sp=0xc000075f78 pc=0x4246e9\n\u003e runtime.bgscavenge(0xc0000240e0)\n\u003e /usr/lib/go-1.22/src/runtime/mgcscavenge.go:653 +0x3c fp=0xc000075fc8 sp=0xc000075fa8 pc=0x424c7c\n\u003e runtime.gcenable.gowrap2()\n\u003e /usr/lib/go-1.22/src/runtime/mgc.go:204 +0x25 fp=0xc000075fe0 sp=0xc000075fc8 pc=0x41b7e5\n\u003e runtime.goexit({})\n\u003e /usr/lib/go-1.22/src/runtime/asm_amd64.s:1695 +0x1 fp=0xc000075fe8 sp=0xc000075fe0 pc=0x46b0e1\n\u003e created by runtime.gcenable in goroutine 1\n\u003e /usr/lib/go-1.22/src/runtime/mgc.go:204 +0xa5\n\u003e \n\u003e goroutine 18 gp=0xc000102700 m=nil [finalizer wait]:\n\u003e runtime.gopark(0xc000074648?, 0x40f445?, 0xa8?, 0x1?, 0xc0000061c0?)\n\u003e /usr/lib/go-1.22/src/runtime/proc.go:402 +0xce fp=0xc000074620 sp=0xc000074600 pc=0x43b98e\n\u003e runtime.runfinq()\n\u003e /usr/lib/go-1.22/src/runtime/mfinal.go:194 +0x107 fp=0xc0000747e0 sp=0xc000074620 pc=0x41a887\n\u003e runtime.goexit({})\n\u003e /usr/lib/go-1.22/src/runtime/asm_amd64.s:1695 +0x1 fp=0xc0000747e8 sp=0xc0000747e0 pc=0x46b0e1\n\u003e created by runtime.createfing in goroutine 1\n\u003e /usr/lib/go-1.22/src/runtime/mfinal.go:164 +0x3d\n\u003e exit status 2\n\u003e ```\n\u003e \n\u003e ## Appendices\n\u003e \n\u003e This problem can also happen with `ProvingKey`.\n\n### Impact\n\nProver and verifier denial of service in case of maliciously crafted inputs (public key, verification key).\n\n### Patches\n\nThe issue is patched in https://github.com/Consensys/gnark/pull/1307. It was merged to gnark master at https://github.com/Consensys/gnark/commit/47ae846339add2bdf9983e499342bfdfe195191d. The fix will be incorporated in the next minor release of gnark (v0.11.1).\n\n### Workarounds\n\nThere are no convenient work-arounds currently. The best approach currently is to run key verification as a separate service which halts the verification pipeline in case of OOM when verification keys come from untrusted sources.","status":"published","published":"2024-10-31T20:37:00Z","modified":"2024-11-04T13:48:59Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:38:15.606692Z"}],"nvd":[{"id":"CVE-2024-50354","description":"gnark is a fast zk-SNARK library that offers a high-level API to design circuits. In gnark 0.11.0 and earlier, deserialization of Groth16 verification keys allocate excessive memory, consuming a lot of resources and triggering a crash with the error fatal error: runtime: out of memory.","status":"published","published":"2024-10-31T16:15:05.763Z","modified":"2026-06-17T08:04:17.623Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:10:35.289159Z"}],"osv":[{"id":"CVE-2024-50354","title":"Out-of-memory during deserialization with crafted inputs","description":"gnark is a fast zk-SNARK library that offers a high-level API to design circuits. In gnark 0.11.0 and earlier, deserialization of Groth16 verification keys allocate excessive memory, consuming a lot of resources and triggering a crash with the error fatal error: runtime: out of memory.","status":"published","published":"2024-10-31T15:59:30.063Z","modified":"2026-10-28T02:30:41.572463882Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:44:44.032344Z"},{"id":"GHSA-cph5-3pgr-c82g","title":"Gnark out-of-memory during deserialization with crafted inputs","description":"Thanks @pventuzelo for reporting.\n\nFrom the correspondence:\n\n\u003e Hi,\n\u003e \n\u003e We (Fuzzinglabs \u0026 Lambdaclass) found that during deserialization of certain files representing a `VerifyingKey`, an excessive memory allocation is happening consuming a lot of resources and even triggering a crash with the error `fatal error: runtime: out of memory`.\n\u003e \n\u003e Please find the details below:\n\u003e \n\u003e ## Vulnerability Details\n\u003e \n\u003e - **Severity:** Critical -\u003e DoS\n\u003e - **Affected Component:** Deserialization\n\u003e \n\u003e ## Environment\n\u003e \n\u003e - **Compiler Version:** go version go1.22.2 linux/amd64\n\u003e - **Distro Version:** Ubuntu 24.04.1 LTS\n\u003e \n\u003e - **Additional Environment Details:**\n\u003e   - `[github.com/consensys/gnark](http://github.com/consensys/gnark) v0.11.0`\n\u003e   - `[github.com/consensys/gnark-crypto](http://github.com/consensys/gnark-crypto) v0.14.1-0.20240909142611-e6b99e74cec1`\n\u003e \n\u003e ## Steps to Reproduce\n\u003e \n\u003e You can download the needed files here: https://drive.google.com/drive/folders/1KQ5I3vv4bUllvqbatGappwbAkIcR2NI_?usp=sharing\n\u003e \n\u003e You have to run\n\u003e \n\u003e ```shell\n\u003e go run gnark_poc.go\n\u003e ```\n\u003e \n\u003e in a terminal.\n\u003e \n\u003e Running the provided code will result in a memory crash or an extremely large memory allocation, which can be observed using the following command:\n\u003e \n\u003e ```shell\n\u003e go tool pprof -web mem.pprof\n\u003e ```\n\u003e \n\u003e ## Root Cause Analysis\n\u003e \n\u003e The provided code loads a `VerifyingKey` from `old.vk` by calling the `ReadFrom` function. This function is implemented in [backend/groth16/bn254/marshal.go](https://github.com/Consensys/gnark/blob/ca8e1568f47ae6b717eda0a6734d87645edaecf7/backend/groth16/bn254/marshal.go#L174C2-L174C25) within the [gnark](https://github.com/Consensys/gnark) library.\n\u003e \n\u003e The provided example uses the elliptic curve BN-254, so the code resides in the [backend/groth16/bn254/](https://github.com/Consensys/gnark/blob/ca8e1568f47ae6b717eda0a6734d87645edaecf7/backend/groth16/bn254/) repertory. However, the same error exists in other repertories, such as [backend/groth16/bls12-377/](https://github.com/Consensys/gnark/blob/ca8e1568f47ae6b717eda0a6734d87645edaecf7/backend/groth16/bls12-377/).\n\u003e \n\u003e At [line 207](https://github.com/Consensys/gnark/blob/ca8e1568f47ae6b717eda0a6734d87645edaecf7/backend/groth16/bn254/marshal.go#L207), a slice is allocated with a length of `nbCommitments`. This variable is directly extracted from the deserialized file, which, in our case, has a value of `2,327,186,600`. This large value may be too big for some configurations, leading to memory allocations of approximately ±1 TB, as observed with `pprof`.\n\u003e \n\u003e ## Detailed Behavior\n\u003e \n\u003e ```shell\n\u003e go run gnark_poc.go\n\u003e ```\n\u003e \n\u003e ```\n\u003e fatal error: runtime: out of memory\n\u003e \n\u003e runtime stack:\n\u003e runtime.throw({0x5fe946?, 0x2052ae?})\n\u003e /usr/lib/go-1.22/src/runtime/panic.go:1023 +0x5c fp=0x7ffd65b321a0 sp=0x7ffd65b32170 pc=0x438a9c\n\u003e runtime.sysMapOS(0xc000400000, 0x8ab6400000)\n\u003e /usr/lib/go-1.22/src/runtime/mem_linux.go:167 +0x11b fp=0x7ffd65b321e0 sp=0x7ffd65b321a0 pc=0x418bbb\n\u003e runtime.sysMap(0xc000400000, 0x8ab6400000, 0x7b19c8?)\n\u003e /usr/lib/go-1.22/src/runtime/mem.go:155 +0x34 fp=0x7ffd65b32200 sp=0x7ffd65b321e0 pc=0x418634\n\u003e runtime.(*mheap).grow(0x7a17c0, 0x455b066?)\n\u003e /usr/lib/go-1.22/src/runtime/mheap.go:1534 +0x236 fp=0x7ffd65b32270 sp=0x7ffd65b32200 pc=0x42b176\n\u003e runtime.(*mheap).allocSpan(0x7a17c0, 0x455b066, 0x0, 0x1)\n\u003e /usr/lib/go-1.22/src/runtime/mheap.go:1246 +0x1b0 fp=0x7ffd65b32310 sp=0x7ffd65b32270 pc=0x42a850\n\u003e runtime.(*mheap).alloc.func1()\n\u003e /usr/lib/go-1.22/src/runtime/mheap.go:964 +0x5c fp=0x7ffd65b32358 sp=0x7ffd65b32310 pc=0x42a2fc\n\u003e runtime.systemstack(0x46d79f)\n\u003e /usr/lib/go-1.22/src/runtime/asm_amd64.s:509 +0x4a fp=0x7ffd65b32368 sp=0x7ffd65b32358 pc=0x46912a\n\u003e \n\u003e goroutine 1 gp=0xc0000061c0 m=0 mp=0x798ca0 [running]:\n\u003e runtime.systemstack_switch()\n\u003e /usr/lib/go-1.22/src/runtime/asm_amd64.s:474 +0x8 fp=0xc000031b68 sp=0xc000031b58 pc=0x4690c8\n\u003e runtime.(*mheap).alloc(0x5bc040?, 0xc00012bb08?, 0xa0?)\n\u003e /usr/lib/go-1.22/src/runtime/mheap.go:958 +0x5b fp=0xc000031bb0 sp=0xc000031b68 pc=0x42a25b\n\u003e runtime.(*mcache).allocLarge(0xc000126510?, 0x8ab60ca800, 0x1)\n\u003e /usr/lib/go-1.22/src/runtime/mcache.go:234 +0x87 fp=0xc000031c00 sp=0xc000031bb0 pc=0x4176e7\n\u003e runtime.mallocgc(0x8ab60ca800, 0x5d92a0, 0x1)\n\u003e /usr/lib/go-1.22/src/runtime/malloc.go:1165 +0x597 fp=0xc000031c88 sp=0xc000031c00 pc=0x40ef97\n\u003e runtime.makeslice(0xc00011c180?, 0x0?, 0x2?)\n\u003e /usr/lib/go-1.22/src/runtime/slice.go:107 +0x49 fp=0xc000031cb0 sp=0xc000031c88 pc=0x4500c9\n\u003e [github.com/consensys/gnark/backend/groth16/bn254.(*VerifyingKey).readFrom(0xc0001b7088](http://github.com/consensys/gnark/backend/groth16/bn254.(*VerifyingKey).readFrom(0xc0001b7088), {0x6598a0, 0xc00011dc50}, 0x0)\n\u003e /home/raunan/go/pkg/mod/[github.com/!ronan!thoraval/gnark@v0.0.0-20241007163125-4c0a7511c3d1/backend/groth16/bn254/marshal.go:214](http://github.com/!ronan!thoraval/gnark@v0.0.0-20241007163125-4c0a7511c3d1/backend/groth16/bn254/marshal.go:214) +0x765 fp=0xc000031ea8 sp=0xc000031cb0 pc=0x59b205\n\u003e [github.com/consensys/gnark/backend/groth16/bn254.(*VerifyingKey).ReadFrom(0x100469020](http://github.com/consensys/gnark/backend/groth16/bn254.(*VerifyingKey).ReadFrom(0x100469020)?, {0x6598a0?, 0xc00011dc50?})\n\u003e /home/raunan/go/pkg/mod/[github.com/!ronan!thoraval/gnark@v0.0.0-20241007163125-4c0a7511c3d1/backend/groth16/bn254/marshal.go:166](http://github.com/!ronan!thoraval/gnark@v0.0.0-20241007163125-4c0a7511c3d1/backend/groth16/bn254/marshal.go:166) +0x1f fp=0xc000031ed8 sp=0xc000031ea8 pc=0x59aa5f\n\u003e main.main()\n\u003e /home/raunan/gnark_poc/gnark_poc/gnark_poc.go:19 +0xba fp=0xc000031f50 sp=0xc000031ed8 pc=0x5addda\n\u003e runtime.main()\n\u003e /usr/lib/go-1.22/src/runtime/proc.go:271 +0x29d fp=0xc000031fe0 sp=0xc000031f50 pc=0x43b55d\n\u003e runtime.goexit({})\n\u003e /usr/lib/go-1.22/src/runtime/asm_amd64.s:1695 +0x1 fp=0xc000031fe8 sp=0xc000031fe0 pc=0x46b0e1\n\u003e \n\u003e goroutine 2 gp=0xc000006c40 m=nil [force gc (idle)]:\n\u003e runtime.gopark(0x0?, 0x0?, 0x0?, 0x0?, 0x0?)\n\u003e /usr/lib/go-1.22/src/runtime/proc.go:402 +0xce fp=0xc000074fa8 sp=0xc000074f88 pc=0x43b98e\n\u003e runtime.goparkunlock(...)\n\u003e /usr/lib/go-1.22/src/runtime/proc.go:408\n\u003e runtime.forcegchelper()\n\u003e /usr/lib/go-1.22/src/runtime/proc.go:326 +0xb3 fp=0xc000074fe0 sp=0xc000074fa8 pc=0x43b813\n\u003e runtime.goexit({})\n\u003e /usr/lib/go-1.22/src/runtime/asm_amd64.s:1695 +0x1 fp=0xc000074fe8 sp=0xc000074fe0 pc=0x46b0e1\n\u003e created by runtime.init.6 in goroutine 1\n\u003e /usr/lib/go-1.22/src/runtime/proc.go:314 +0x1a\n\u003e \n\u003e goroutine 3 gp=0xc000007180 m=nil [GC sweep wait]:\n\u003e runtime.gopark(0x0?, 0x0?, 0x0?, 0x0?, 0x0?)\n\u003e /usr/lib/go-1.22/src/runtime/proc.go:402 +0xce fp=0xc000075780 sp=0xc000075760 pc=0x43b98e\n\u003e runtime.goparkunlock(...)\n\u003e /usr/lib/go-1.22/src/runtime/proc.go:408\n\u003e runtime.bgsweep(0xc0000240e0)\n\u003e /usr/lib/go-1.22/src/runtime/mgcsweep.go:278 +0x94 fp=0xc0000757c8 sp=0xc000075780 pc=0x426cf4\n\u003e runtime.gcenable.gowrap1()\n\u003e /usr/lib/go-1.22/src/runtime/mgc.go:203 +0x25 fp=0xc0000757e0 sp=0xc0000757c8 pc=0x41b845\n\u003e runtime.goexit({})\n\u003e /usr/lib/go-1.22/src/runtime/asm_amd64.s:1695 +0x1 fp=0xc0000757e8 sp=0xc0000757e0 pc=0x46b0e1\n\u003e created by runtime.gcenable in goroutine 1\n\u003e /usr/lib/go-1.22/src/runtime/mgc.go:203 +0x66\n\u003e \n\u003e goroutine 4 gp=0xc000007340 m=nil [GC scavenge wait]:\n\u003e runtime.gopark(0xc0000240e0?, 0x657100?, 0x1?, 0x0?, 0xc000007340?)\n\u003e /usr/lib/go-1.22/src/runtime/proc.go:402 +0xce fp=0xc000075f78 sp=0xc000075f58 pc=0x43b98e\n\u003e runtime.goparkunlock(...)\n\u003e /usr/lib/go-1.22/src/runtime/proc.go:408\n\u003e runtime.(*scavengerState).park(0x797520)\n\u003e /usr/lib/go-1.22/src/runtime/mgcscavenge.go:425 +0x49 fp=0xc000075fa8 sp=0xc000075f78 pc=0x4246e9\n\u003e runtime.bgscavenge(0xc0000240e0)\n\u003e /usr/lib/go-1.22/src/runtime/mgcscavenge.go:653 +0x3c fp=0xc000075fc8 sp=0xc000075fa8 pc=0x424c7c\n\u003e runtime.gcenable.gowrap2()\n\u003e /usr/lib/go-1.22/src/runtime/mgc.go:204 +0x25 fp=0xc000075fe0 sp=0xc000075fc8 pc=0x41b7e5\n\u003e runtime.goexit({})\n\u003e /usr/lib/go-1.22/src/runtime/asm_amd64.s:1695 +0x1 fp=0xc000075fe8 sp=0xc000075fe0 pc=0x46b0e1\n\u003e created by runtime.gcenable in goroutine 1\n\u003e /usr/lib/go-1.22/src/runtime/mgc.go:204 +0xa5\n\u003e \n\u003e goroutine 18 gp=0xc000102700 m=nil [finalizer wait]:\n\u003e runtime.gopark(0xc000074648?, 0x40f445?, 0xa8?, 0x1?, 0xc0000061c0?)\n\u003e /usr/lib/go-1.22/src/runtime/proc.go:402 +0xce fp=0xc000074620 sp=0xc000074600 pc=0x43b98e\n\u003e runtime.runfinq()\n\u003e /usr/lib/go-1.22/src/runtime/mfinal.go:194 +0x107 fp=0xc0000747e0 sp=0xc000074620 pc=0x41a887\n\u003e runtime.goexit({})\n\u003e /usr/lib/go-1.22/src/runtime/asm_amd64.s:1695 +0x1 fp=0xc0000747e8 sp=0xc0000747e0 pc=0x46b0e1\n\u003e created by runtime.createfing in goroutine 1\n\u003e /usr/lib/go-1.22/src/runtime/mfinal.go:164 +0x3d\n\u003e exit status 2\n\u003e ```\n\u003e \n\u003e ## Appendices\n\u003e \n\u003e This problem can also happen with `ProvingKey`.\n\n### Impact\n\nProver and verifier denial of service in case of maliciously crafted inputs (public key, verification key).\n\n### Patches\n\nThe issue is patched in https://github.com/Consensys/gnark/pull/1307. It was merged to gnark master at https://github.com/Consensys/gnark/commit/47ae846339add2bdf9983e499342bfdfe195191d. The fix will be incorporated in the next minor release of gnark (v0.11.1).\n\n### Workarounds\n\nThere are no convenient work-arounds currently. The best approach currently is to run key verification as a separate service which halts the verification pipeline in case of OOM when verification keys come from untrusted sources.","status":"published","published":"2024-10-31T20:37:00Z","modified":"2024-11-04T13:48:55Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:45.28161Z"},{"id":"GO-2024-3244","title":"Gnark out-of-memory during deserialization with crafted inputs in github.com/consensys/gnark","description":"Gnark out-of-memory during deserialization with crafted inputs in github.com/consensys/gnark","status":"published","published":"2024-11-01T21:55:10Z","modified":"2025-02-06T17:50:03Z","updated_at":"2026-11-02T15:47:01.453823Z"},{"id":"openSUSE-SU-2024:0350-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20241104T154416 2024-11-04T15:44:16Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3233 CVE-2024-46872 GHSA-762g-9p7f-mrww\n  * GO-2024-3234 CVE-2024-47401 GHSA-762v-rq7q-ff97\n  * GO-2024-3235 CVE-2024-50052 GHSA-g376-m3h3-mj4r\n  * GO-2024-3237 CVE-2024-0133 GHSA-f748-7hpg-88ch\n  * GO-2024-3239 CVE-2024-0132 GHSA-mjjw-553x-87pq\n  * GO-2024-3240 CVE-2024-10452 GHSA-66c4-2g2v-54qw\n  * GO-2024-3241 CVE-2024-10006 GHSA-5c4w-8hhh-3c3h\n  * GO-2024-3242 CVE-2024-10086 GHSA-99wr-c2px-grmh\n  * GO-2024-3243 CVE-2024-10005 GHSA-chgm-7r52-whjj\n\n- Update to version 0.0.20241101T215616 2024-11-01T21:56:16Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3244 CVE-2024-50354 GHSA-cph5-3pgr-c82g\n  * GO-2024-3245 CVE-2024-39720\n  * GO-2024-3246 CVE-2024-8185 GHSA-g233-2p4r-3q7v\n\n- Update to version 0.0.20241030T212825 2024-10-30T21:28:25Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3230 CVE-2024-48921 GHSA-qjvc-p88j-j9rm\n  * GO-2024-3232 CVE-2024-10241 GHSA-6mvp-gh77-7vwh\n\n- Update to version 0.0.20241030T160108 2024-10-30T16:01:08Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3226 CVE-2024-47827 GHSA-ghjw-32xw-ffwr\n  * GO-2024-3227 CVE-2024-10214 GHSA-hm57-h27x-599c\n  * GO-2024-3228 GHSA-wcx9-ccpj-hx3c\n- Packaging improvments:\n  * Backfill CVE aliases in recent changelog entries\n\n- Update to version 0.0.20241028T152002 2024-10-28T15:20:02Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3207 GHSA-p5wf-cmr4-xrwr\n  * GO-2024-3208 CVE-2024-47825 GHSA-3wwx-63fv-pfq6\n  * GO-2024-3210 CVE-2024-8901\n  * GO-2024-3211 CVE-2024-50312\n  * GO-2024-3212 GHSA-rjfv-pjvx-mjgv\n  * GO-2024-3213 CVE-2024-49380\n  * GO-2024-3214 CVE-2024-49381\n  * GO-2024-3215 CVE-2024-9264 GHSA-q99m-qcv4-fpm7\n  * GO-2024-3216 CVE-2024-49753 GHSA-6cf5-w9h3-4rqv\n  * GO-2024-3217 CVE-2024-49757 GHSA-3rmw-76m6-4gjc\n  * GO-2024-3219 GHSA-7h65-4p22-39j6\n  * GO-2024-3220 CVE-2023-32197 GHSA-7h8m-pvw3-5gh4\n  * GO-2024-3221 CVE-2024-22036 GHSA-h99m-6755-rgwc\n  * GO-2024-3222 GHSA-x7xj-jvwp-97rv\n  * GO-2024-3223 CVE-2022-45157 GHSA-xj7w-r753-vj8v\n  * GO-2024-3224 CVE-2024-39223 GHSA-8wxx-35qc-vp6r\n\n- Update to version 0.0.20241017T153730 date 2024-10-17T15:37:30Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3189 CVE-2024-38365 GHSA-27vh-h6mc-q6g8\n  * GO-2024-3203 CVE-2024-9486\n  * GO-2024-3204 CVE-2024-9594\n\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3189 CVE-2024-38365 GHSA-27vh-h6mc-q6g8\n  * GO-2024-3196 CVE-2024-47877 GHSA-8rm2-93mq-jqhc\n  * GO-2024-3199 GHSA-vv6c-69r6-chg9\n  * GO-2024-3200 CVE-2024-48909 GHSA-3c32-4hq9-6wgj\n  * GO-2024-3201 CVE-2023-22644\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3166 CVE-2024-47534 GHSA-4f8r-qqr9-fq8j\n  * GO-2024-3171 CVE-2024-9341 GHSA-mc76-5925-c5p6\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3161 CVE-2024-22030 GHSA-h4h5-9833-v2p4\n  * GO-2024-3162 CVE-2024-7594 GHSA-jg74-mwgw-v6x3\n  * GO-2024-3163 CVE-2024-47182\n  * GO-2024-3164 CVE-2024-47003 GHSA-59hf-mpf8-pqjh\n  * GO-2024-3166 CVE-2024-47534 GHSA-4f8r-qqr9-fq8j\n  * GO-2024-3167 CVE-2024-9355 GHSA-3h3x-2hwv-hr52\n  * GO-2024-3168 CVE-2024-8975 GHSA-chqx-36rm-rf8h\n  * GO-2024-3169 CVE-2024-9407 GHSA-fhqq-8f65-5xfc\n  * GO-2024-3170 CVE-2024-8996 GHSA-m5gv-m5f9-wgv4\n  * GO-2024-3172 CVE-2024-33662 GHSA-9mjw-79r6-c9m8\n  * GO-2024-3173 CVE-2024-7558 GHSA-mh98-763h-m9v4\n  * GO-2024-3174 CVE-2024-8037 GHSA-8v4w-f4r9-7h6x\n  * GO-2024-3175 CVE-2024-8038 GHSA-xwgj-vpm9-q2rq\n  * GO-2024-3179 CVE-2024-47616 GHSA-r7rh-jww5-5fjr\n  * GO-2024-3181 CVE-2024-9313 GHSA-x5q3-c8rm-w787\n  * GO-2024-3182 GHSA-wpr2-j6gr-pjw9\n  * GO-2024-3184 CVE-2024-36814 GHSA-9cp9-8gw2-8v7m\n  * GO-2024-3185 CVE-2024-47832\n  * GO-2024-3186 CVE-2024-9675 GHSA-586p-749j-fhwp\n  * GO-2024-3188 CVE-2024-9312 GHSA-4gfw-wf7c-w6g2\n  * GO-2024-3190 CVE-2024-47067 GHSA-8pph-gfhp-w226\n  * GO-2024-3191 CVE-2024-9180 GHSA-rr8j-7w34-xp5j","status":"published","published":"2024-11-05T14:52:20Z","modified":"2026-02-04T12:23:04.839834Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:14452-1","title":"govulncheck-vulndb-0.0.20241101T215616-1.1 on GA media","description":"These are all security issues fixed in the govulncheck-vulndb-0.0.20241101T215616-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-11-02T00:00:00Z","modified":"2025-05-07T18:16:08.81999Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"SUSE-SU-2024:3950-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20241104T154416 2024-11-04T15:44:16Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3233 CVE-2024-46872 GHSA-762g-9p7f-mrww\n  * GO-2024-3234 CVE-2024-47401 GHSA-762v-rq7q-ff97\n  * GO-2024-3235 CVE-2024-50052 GHSA-g376-m3h3-mj4r\n  * GO-2024-3237 CVE-2024-0133 GHSA-f748-7hpg-88ch\n  * GO-2024-3239 CVE-2024-0132 GHSA-mjjw-553x-87pq\n  * GO-2024-3240 CVE-2024-10452 GHSA-66c4-2g2v-54qw\n  * GO-2024-3241 CVE-2024-10006 GHSA-5c4w-8hhh-3c3h\n  * GO-2024-3242 CVE-2024-10086 GHSA-99wr-c2px-grmh\n  * GO-2024-3243 CVE-2024-10005 GHSA-chgm-7r52-whjj\n\n- Update to version 0.0.20241101T215616 2024-11-01T21:56:16Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3244 CVE-2024-50354 GHSA-cph5-3pgr-c82g\n  * GO-2024-3245 CVE-2024-39720\n  * GO-2024-3246 CVE-2024-8185 GHSA-g233-2p4r-3q7v\n","status":"published","published":"2024-11-08T07:57:33Z","modified":"2026-02-05T09:53:39.58165Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2025:0429-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20250207T224745 2025-02-07T22:47:45Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3456 CVE-2025-24786 GHSA-9r4c-jwx3-3j76\n  * GO-2025-3457 CVE-2025-24787 GHSA-c7w4-9wv8-7x7c\n  * GO-2025-3458 CVE-2025-24366 GHSA-vj7w-3m8c-6vpx\n\n- Update to version 0.0.20250206T175003 2025-02-06T17:50:03Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2023-1867 CVE-2022-47930 GHSA-c58h-qv6g-fw74\n  * GO-2024-3244 CVE-2024-50354 GHSA-cph5-3pgr-c82g\n\n- Update to version 0.0.20250206T165438 2025-02-06T16:54:38Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3428 CVE-2025-22867\n  * GO-2025-3447 CVE-2025-22866\n\n- Update to version 0.0.20250205T232745 2025-02-05T23:27:45Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3408\n  * GO-2025-3448 GHSA-23qp-3c2m-xx6w\n  * GO-2025-3449 GHSA-mx2j-7cmv-353c\n  * GO-2025-3450 GHSA-w7wm-2425-7p2h\n  * GO-2025-3454 GHSA-mj4v-hp69-27x5\n  * GO-2025-3455 GHSA-vqv5-385r-2hf8\n\n- Update to version 0.0.20250205T003520 2025-02-05T00:35:20Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3451\n\n- Update to version 0.0.20250204T220613 2025-02-04T22:06:13Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3431 CVE-2025-24884 GHSA-hcr5-wv4p-h2g2\n  * GO-2025-3433 CVE-2025-23216 GHSA-47g2-qmh2-749v\n  * GO-2025-3434 CVE-2025-24376 GHSA-fc89-jghx-8pvg\n  * GO-2025-3435 CVE-2025-24784 GHSA-756x-m4mj-q96c\n  * GO-2025-3436 CVE-2025-24883 GHSA-q26p-9cq4-7fc2\n  * GO-2025-3437 GHSA-274v-mgcv-cm8j\n  * GO-2025-3438 CVE-2024-11741 GHSA-wxcc-2f3q-4h58\n  * GO-2025-3442 CVE-2025-24371 GHSA-22qq-3xwm-r5x4\n  * GO-2025-3443 GHSA-r3r4-g7hq-pq4f\n  * GO-2025-3444 CVE-2024-35177\n  * GO-2025-3445 CVE-2024-47770\n\n- Use standard RPM macros to unpack the source and populate a\n  working directory. Fixes build with RPM 4.20.\n\n- Update to version 0.0.20250130T185858 2025-01-30T18:58:58Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-2842 CVE-2024-3727 GHSA-6wvf-f2vw-3425\n  * GO-2024-3181 CVE-2024-9313 GHSA-x5q3-c8rm-w787\n  * GO-2024-3188 CVE-2024-9312 GHSA-4gfw-wf7c-w6g2\n  * GO-2025-3372 CVE-2024-45339 GHSA-6wxm-mpqj-6jpf\n  * GO-2025-3373 CVE-2024-45341\n  * GO-2025-3383 CVE-2024-45340\n  * GO-2025-3408\n  * GO-2025-3412 CVE-2024-10846 GHSA-36gq-35j3-p9r9\n  * GO-2025-3420 CVE-2024-45336\n  * GO-2025-3421 CVE-2025-22865\n  * GO-2025-3424 CVE-2025-24369\n  * GO-2025-3426 CVE-2025-0750 GHSA-hp5j-2585-qx6g\n  * GO-2025-3427 CVE-2024-13484 GHSA-58fx-7v9q-3g56\n","status":"published","published":"2025-02-11T14:12:30Z","modified":"2026-02-05T00:10:56.097493Z","updated_at":"2026-11-02T15:53:58.883365Z"}]}}