CVE-2024-50354
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-50354
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-50354.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2024-50354
- Aliases
- Downstream
- Related
- Published
- 2024-10-31T15:59:30.063Z
- Modified
- 2025-12-01T17:46:10.075901Z
- Severity
-
- 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- Out-of-memory during deserialization with crafted inputs
- Details
-
gnark is a fast zk-SNARK library that offers a high-level API to design circuits. In gnark 0.11.0 and earlier, deserialization of Groth16 verification keys allocate excessive memory, consuming a lot of resources and triggering a crash with the error fatal error: runtime: out of memory.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50354.json", "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-400" ] }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50354.json
- https://github.com/Consensys/gnark/commit/47ae846339add2bdf9983e499342bfdfe195191d
- https://github.com/Consensys/gnark/pull/1307
- https://github.com/Consensys/gnark/security/advisories/GHSA-cph5-3pgr-c82g
- https://nvd.nist.gov/vuln/detail/CVE-2024-50354