CVE-2024-50354: Gnark out-of-memory during deserialization with crafted inputs

October 31, 2024 (updated November 4, 2024)

Thanks @pventuzelo for reporting.

From the correspondence:

References

github.com/Consensys/gnark
github.com/Consensys/gnark/commit/47ae846339add2bdf9983e499342bfdfe195191d
github.com/Consensys/gnark/pull/1307
github.com/Consensys/gnark/security/advisories/GHSA-cph5-3pgr-c82g
github.com/advisories/GHSA-cph5-3pgr-c82g
nvd.nist.gov/vuln/detail/CVE-2024-50354

Code Behaviors & Features

Detect and mitigate CVE-2024-50354 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →