What is CVE-2024-45039?

CVE-2024-45039 is a medium-severity vulnerability in Consensys Gnark, classified under Information Disclosure. CVSS score: 6.2/10. Published 2024-09-06.

How severe is CVE-2024-45039?

Medium severity. CVSS v3 base score is 6.2 out of 10.

Information disclosure in Consensys Gnark

CVE-2024-45039

gnark is a fast zk-SNARK library that offers a high-level API to design circuits. Versions prior to 0.11.0 have a soundness issue - in case of multiple commitments used inside the circuit the prover is able to choose all but the last commitment. As gnark uses the commitments for optimized non-native multiplication, lookup checks etc. as random challenges, then it could impact the soundness of the whole circuit. However, using multiple commitments has been discouraged due to the additional cost to the verifier and it has not been supported in the recursive in-circuit Groth16 verifier and Solidity verifier. gnark's maintainers expect the impact of the issue be very small - only for the users who have implemented the native Groth16 verifier or are using it with multiple commitments. We do not have information of such users. The issue has been patched in version 0.11.0. As a workaround, users should follow gnark maintainers' recommendation to use only a single commitment and then derive in-circuit commitments as needed using the `std/multicommit` package.

Vulnerability class: Information Disclosure

Published 2024-09-06 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 6.2 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.

EPSS exploit prediction

EPSS: 0.002 (7.7th percentile), scored 2026-09-30.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 8th percentile — 7.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000

Affected products

Consensys Gnark — versions < 0.11.0
Consensys Gnark-Crypto

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

github.com/Consensys/gnark/security/advisories/GHSA-q3hw-3gm4-w5cr (Third Party Advisory)
github.com/Consensys/gnark/commit/e7c66b000454f4d2a4ae48c005c34154d4cfc2a2 (Broken Link)

Frequently asked questions

What is CVE-2024-45039?: CVE-2024-45039 is a medium-severity vulnerability in Consensys Gnark, classified under Information Disclosure. CVSS score: 6.2/10. Published 2024-09-06.
How severe is CVE-2024-45039?: Medium severity. CVSS v3 base score is 6.2 out of 10.