CVE-2026-61618

A flaw was found in snark-verifier. Accumulator limbs are decoded without consistently enforcing canonical bounds before reconstructing elliptic-curve coordinates. A remote attacker can exploit this flaw by submitting proofs with non-canonical encodings, causing the native verifier to panic and...

CVE-2026-62337

SNARK Verifier is a generic SNARK verifier. Prior to 0.2.5, the Halo 2 aggregation circuit can mishandle proof points encoded as the point at infinity. EcPointLoader::multiscalarmultiplication places a Value::Assigned base paired with Value::ConstantONE into its unscaled variable-base list and...

CVE-2026-61618

SNARK Verifier is a generic SNARK verifier. Prior to 0.2.5, KZG accumulator public-instance limbs are decoded without consistently enforcing canonical limb bounds before elliptic-curve coordinate reconstruction. PlonkProof::read selects scalars using accumulatorindices and passes them to...

CVE-2026-62337 SNARK Verifier: Halo 2 aggregation mishandles point-at-infinity proof elements

SNARK Verifier is a generic SNARK verifier. Prior to 0.2.5, the Halo 2 aggregation circuit can mishandle proof points encoded as the point at infinity. EcPointLoader::multiscalarmultiplication places a Value::Assigned base paired with Value::ConstantONE into its unscaled variable-base list and...

CVE-2026-62337 SNARK Verifier: Halo 2 aggregation mishandles point-at-infinity proof elements

SNARK Verifier is a generic SNARK verifier. Prior to 0.2.5, the Halo 2 aggregation circuit can mishandle proof points encoded as the point at infinity. EcPointLoader::multiscalarmultiplication places a Value::Assigned base paired with Value::ConstantONE into its unscaled variable-base list and...

CVE-2026-62337 SNARK Verifier: Halo 2 aggregation mishandles point-at-infinity proof elements

SNARK Verifier is a generic SNARK verifier. Prior to 0.2.5, the Halo 2 aggregation circuit can mishandle proof points encoded as the point at infinity. EcPointLoader::multiscalarmultiplication places a Value::Assigned base paired with Value::ConstantONE into its unscaled variable-base list and...

EUVD-2026-114436

SNARK Verifier is a generic SNARK verifier. Prior to 0.2.5, the Halo 2 aggregation circuit can mishandle proof points encoded as the point at infinity. EcPointLoader::multiscalarmultiplication places a Value::Assigned base paired with Value::ConstantONE into its unscaled variable-base list and...

CVE-2026-62337

The SNARK Verifier generic verifier is vulnerable to a flaw in the Halo 2 aggregation circuit prior to version 0.2.5 . The root cause is that EcPointLoader::multi_scalar_multiplication passes a base paired with Value::Constant(ONE) to sum_with_const, which delegates to halo2-lib's EccChip::sum. B...

EUVD-2026-114397

SNARK Verifier is a generic SNARK verifier. Prior to 0.2.5, KZG accumulator public-instance limbs are decoded without consistently enforcing canonical limb bounds before elliptic-curve coordinate reconstruction. PlonkProof::read selects scalars using accumulatorindices and passes them to...

CVE-2026-61618 SNARK Verifier: noncanonical accumulator limb decoding

SNARK Verifier is a generic SNARK verifier. Prior to 0.2.5, KZG accumulator public-instance limbs are decoded without consistently enforcing canonical limb bounds before elliptic-curve coordinate reconstruction. PlonkProof::read selects scalars using accumulatorindices and passes them to...

CVE-2026-61618

Prior to version 0.2.5 , SNARK Verifier is vulnerable to a denial-of-service condition due to noncanonical KZG accumulator public-instance limbs being decoded without consistent enforcement of limb bounds. Specifically, in the EVM loader (snark-verifier/src/loader/evm/loader.rs), shl and add oper...

CVE-2026-61618 SNARK Verifier: noncanonical accumulator limb decoding

SNARK Verifier is a generic SNARK verifier. Prior to 0.2.5, KZG accumulator public-instance limbs are decoded without consistently enforcing canonical limb bounds before elliptic-curve coordinate reconstruction. PlonkProof::read selects scalars using accumulatorindices and passes them to...

PT-2026-134193

SNARK Verifier is a generic SNARK verifier. Prior to 0.2.5, the Halo 2 aggregation circuit can mishandle proof points encoded as the point at infinity. EcPointLoader::multi scalar multiplication places a Value::Assigned base paired with Value::ConstantONE into its unscaled variable-base list and...

PT-2026-134172

SNARK Verifier is a generic SNARK verifier. Prior to 0.2.5, KZG accumulator public-instance limbs are decoded without consistently enforcing canonical limb bounds before elliptic-curve coordinate reconstruction. PlonkProof::read selects scalars using accumulator indices and passes them to...

CVE-2026-62337: axiom-crypto snark-verifier: SNARK Verifier is a generic (S)NARK verifier

SNARK Verifier is a generic SNARK verifier. Prior to 0.2.5, the Halo 2 aggregation circuit can mishandle proof points encoded as the point at infinity. EcPointLoader::multiscalarmultiplication places a Value::Assigned base paired with Value::ConstantONE into its unscaled variable-base list and...

CVE-2026-61618: axiom-crypto snark-verifier: SNARK Verifier is a generic (S)NARK verifier

SNARK Verifier is a generic SNARK verifier. Prior to 0.2.5, KZG accumulator public-instance limbs are decoded without consistently enforcing canonical limb bounds before elliptic-curve coordinate reconstruction. PlonkProof::read selects scalars using accumulatorindices and passes them to...

CVE-2019-7167

Zcash, before the Sapling network upgrade 2018-10-28, had a counterfeiting vulnerability. A key-generation process, during evaluation of polynomials related to a to-be-proven statement, produced certain bypass elements. Availability of these elements allowed a cheating prover to bypass a...

Design/Logic Flaw

Zcash, before the Sapling network upgrade 2018-10-28, had a counterfeiting vulnerability. A key-generation process, during evaluation of polynomials related to a to-be-proven statement, produced certain bypass elements. Availability of these elements allowed a cheating prover to bypass a...

CVE-2019-7167

Zcash, before the Sapling network upgrade 2018-10-28, had a counterfeiting vulnerability. A key-generation process, during evaluation of polynomials related to a to-be-proven statement, produced certain bypass elements. Availability of these elements allowed a cheating prover to bypass a...

CVE-2019-7167

CVE-2019-7167 concerns Zcash prior to the Sapling upgrade (2018-10-28), where a flaw in the key-generation process during polynomial evaluation allowed bypass elements to defeat a consistency check. This could enable a cheating prover to transform a proof of one statement into a seemingly valid p...