CVE-2023-44378

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

gnark is a zk-SNARK library that offers a high-level API to design circuits. Prior to version 0.9.0, for some in-circuit values, it is possible to construct two valid decomposition to bits. In addition to the canonical decomposition of `a`, for small values there exists a second decomposition for `a+r` (where `r` is the modulus the values are being reduced by). The second decomposition was possible due to overflowing the field where the values are defined. Upgrading to version 0.9.0 should fix the issue without needing to change the calls to value comparison methods.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-191 CWE-697

Affected software

No affected versions have been published.

Timeline

Published: Oct 9, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-443796.1baserCMS is a website development framework. Prior to version 5.0.9, there is a cross-site scripting vulnerability in the site search featur CVE-2023-44389.8A vulnerability has been found in SourceCodester Inventory Management System 1.0 and classified as critical. Affected by this vulnerability CVE-2023-443814.9October is a Content Management System (CMS) and web platform to assist with development workflow. An authenticated backend user with the `e CVE-2023-443829.1October is a Content Management System (CMS) and web platform to assist with development workflow. An authenticated backend user with the `e CVE-2023-443835.4October is a Content Management System (CMS) and web platform to assist with development workflow. A user with access to the media manager t CVE-2023-443844.1Discourse-jira is a Discourse plugin allows Jira projects, issue types, fields and field options will be synced automatically. An administra CVE-2023-443858.8The Home Assistant Companion for iOS and macOS app up to version 2023.4 are vulnerable to Client-Side Request Forgery. Attackers may send ma CVE-2023-443865.3Vapor is an HTTP web framework for Swift. There is a denial of service vulnerability impacting all users of affected versions of Vapor. The CVE-2023-443876.5Gradle is a build tool with a focus on build automation and support for multi-language development. When copying or archiving symlinked file CVE-2023-443887.5Discourse is an open source platform for community discussion. A malicious request can cause production log files to quickly fill up and thu CVE-2023-443894.8Zope is an open-source web application server. The title property, available on most Zope objects, can be used to store script code that is CVE-2023-44395.3A vulnerability was found in SourceCodester Card Holder Management System 1.0 and classified as problematic. Affected by this issue is some