CVE-2026-62337

The SNARK Verifier generic verifier is vulnerable to a flaw in the Halo 2 aggregation circuit prior to version 0.2.5 . The root cause is that EcPointLoader::multi_scalar_multiplication passes a base paired with Value::Constant(ONE) to sum_with_const, which delegates to halo2-lib's EccChip::sum. B...

CVE-2026-61618

Prior to version 0.2.5 , SNARK Verifier is vulnerable to a denial-of-service condition due to noncanonical KZG accumulator public-instance limbs being decoded without consistent enforcement of limb bounds. Specifically, in the EVM loader (snark-verifier/src/loader/evm/loader.rs), shl and add oper...

CVE-2026-61618 SNARK Verifier: noncanonical accumulator limb decoding

SNARK Verifier is a generic SNARK verifier. Prior to 0.2.5, KZG accumulator public-instance limbs are decoded without consistently enforcing canonical limb bounds before elliptic-curve coordinate reconstruction. PlonkProof::read selects scalars using accumulatorindices and passes them to...

CVE-2026-61618: axiom-crypto snark-verifier: SNARK Verifier is a generic (S)NARK verifier

SNARK Verifier is a generic SNARK verifier. Prior to 0.2.5, KZG accumulator public-instance limbs are decoded without consistently enforcing canonical limb bounds before elliptic-curve coordinate reconstruction. PlonkProof::read selects scalars using accumulatorindices and passes them to...

CVE-2026-62337: axiom-crypto snark-verifier: SNARK Verifier is a generic (S)NARK verifier

SNARK Verifier is a generic SNARK verifier. Prior to 0.2.5, the Halo 2 aggregation circuit can mishandle proof points encoded as the point at infinity. EcPointLoader::multiscalarmultiplication places a Value::Assigned base paired with Value::ConstantONE into its unscaled variable-base list and...

CVE-2019-7167

Zcash, before the Sapling network upgrade 2018-10-28, had a counterfeiting vulnerability. A key-generation process, during evaluation of polynomials related to a to-be-proven statement, produced certain bypass elements. Availability of these elements allowed a cheating prover to bypass a...

Design/Logic Flaw

Zcash, before the Sapling network upgrade 2018-10-28, had a counterfeiting vulnerability. A key-generation process, during evaluation of polynomials related to a to-be-proven statement, produced certain bypass elements. Availability of these elements allowed a cheating prover to bypass a...

CVE-2019-7167

CVE-2019-7167 concerns Zcash prior to the Sapling upgrade (2018-10-28), where a flaw in the key-generation process during polynomial evaluation allowed bypass elements to defeat a consistency check. This could enable a cheating prover to transform a proof of one statement into a seemingly valid p...

CVE-2019-7167

Zcash, before the Sapling network upgrade 2018-10-28, had a counterfeiting vulnerability. A key-generation process, during evaluation of polynomials related to a to-be-proven statement, produced certain bypass elements. Availability of these elements allowed a cheating prover to bypass a...