CVE-2025-58157: Consensys Gnark DOS Vulnerability

CVE-2025-58157 Overview

CVE-2025-58157 is a denial of service vulnerability in gnark, a zero-knowledge proof system framework developed by Consensys. The flaw exists in version 0.12.0 and stems from the fake-GLV algorithm used during scalar multiplication. For certain inputs, the underlying Eisenstein Half-GCD computation fails to converge quickly enough, causing excessive resource consumption. The issue is patched in version 0.13.0 of gnark and the corresponding fix in gnark-crypto.

Critical Impact
Remote attackers can submit crafted scalar inputs that cause the fake-GLV scalar multiplication routine to consume excessive compute resources, resulting in denial of service against applications relying on gnark for zero-knowledge proof generation or verification.

Affected Products

Consensys gnark version 0.12.0
Consensys gnark-crypto (Eisenstein Half-GCD component) prior to commit 56600883e0e9f9b159e9c7000b94e76185ec3d0d
Applications and zero-knowledge proof pipelines that depend on the affected gnark release

Discovery Timeline

2025-08-29 - CVE CVE-2025-58157 published to NVD
2025-09-24 - Last updated in NVD database

Technical Details for CVE-2025-58157

Vulnerability Analysis

The vulnerability is a resource exhaustion issue [CWE-400] in the fake-GLV scalar multiplication routine. The fake-GLV technique decomposes a scalar into smaller components using a lattice reduction step, which gnark-crypto implements via an Eisenstein Half-GCD algorithm over the hexagonal lattice. For specific scalar inputs, including negative scalars, the reduction loop fails to converge within the expected number of iterations.

Non-convergence causes the scalar multiplication operation to run far longer than the bounded cost a caller would normally assume. An attacker who can influence scalar inputs to a prover or verifier can trigger this pathological behavior. The result is sustained CPU consumption and unavailability of the affected service.

Root Cause

The root cause lies in the Eisenstein Half-GCD implementation in field/eisenstein/eisenstein.go. The original routine used rounding and lattice-step selection logic that did not reliably reduce the norm for all valid inputs. A secondary defect in gnark itself mishandled negative scalars passed to the fake-GLV path, compounding the convergence problem.

Attack Vector

Attack delivery is over the network with no authentication or user interaction required. Any interface that accepts attacker-influenced scalars and routes them through gnark's fake-GLV scalar multiplication is reachable. Only availability is impacted; confidentiality and integrity of cryptographic operations are not directly affected.

// Patch excerpt: field/eisenstein/eisenstein.go
// fix: Eisenstein Half-GCD convergence (#680)

// six axial directions of the hexagonal lattice
var neighbours = [][2]int64{
    {1, 0}, {0, 1}, {-1, 1}, {-1, 0}, {0, -1}, {1, -1},
}

// roundNearest returns ⌊(z + d/2) / d⌋  for *any* sign of z, d>0
func roundNearest(z, d *big.Int) *big.Int {
    half := new(big.Int).Rsh(d, 1) // d / 2
    if z.Sign() >= 0 {
        return new(big.Int).Div(new(big.Int).Add(z, half), d)
    }
    tmp := new(big.Int).Neg(z)
    tmp.Add(tmp, half)
    tmp.Div(tmp, d)
    return tmp.Neg(tmp)
}

Source: gnark-crypto commit 56600883. The patch rewrites the lattice rounding helpers and neighbour search so the Half-GCD loop converges for all sign combinations of the input scalars.

Detection Methods for CVE-2025-58157

Indicators of Compromise

Long-running goroutines stuck inside gnark-crypto Eisenstein or fake-GLV code paths
Sustained 100% CPU utilization on hosts running gnark-based provers or verifiers without corresponding throughput
Repeated request timeouts on endpoints that accept user-supplied scalars, field elements, or proof witnesses

Detection Strategies

Inventory Go applications and identify those importing github.com/consensys/gnark at version v0.12.0 or github.com/consensys/gnark-crypto pinned before commit 56600883e0e9f9b159e9c7000b94e76185ec3d0d.
Use software composition analysis to flag vulnerable module versions in go.mod and go.sum files across build pipelines.
Profile production services with pprof to identify abnormal time spent in eisenstein or fake-GLV routines.

Monitoring Recommendations

Alert on outlier execution time for individual proof generation or verification calls compared to historical baselines.
Monitor CPU saturation and request latency on services exposing zero-knowledge proof endpoints to untrusted clients.
Capture and review crash or timeout traces from gnark-based services for stacks pointing to scalar multiplication functions.

How to Mitigate CVE-2025-58157

Immediate Actions Required

Upgrade github.com/consensys/gnark to version 0.13.0 or later in all affected services.
Update transitive dependency github.com/consensys/gnark-crypto to a release containing commit 56600883e0e9f9b159e9c7000b94e76185ec3d0d (for example v0.17.1-0.20250502112255-56600883e0e9).
Rebuild and redeploy any binaries or container images that statically link the vulnerable library.

Patch Information

The issue is fixed by two commits. The convergence fix in gnark-crypto is published in gnark-crypto commit 56600883. The negative-scalar handling fix in gnark and the dependency bump are published in gnark commit 68be6ced. Additional context is available in the GitHub Security Advisory GHSA-9fvj-xqr2-xwg8 and GitHub Issue #1483.

Workarounds

Enforce strict input validation and bounds on any scalar values supplied by untrusted clients before passing them to gnark APIs.
Apply per-request execution timeouts and CPU quotas around proof generation and verification calls to bound worst-case cost.
Rate-limit or authenticate endpoints that invoke fake-GLV scalar multiplication until the upgrade can be deployed.

bash

# Update gnark to the patched release in your Go module
go get github.com/consensys/gnark@v0.13.0
go mod tidy

# Verify the resolved gnark-crypto version includes the convergence fix
go list -m github.com/consensys/gnark-crypto
# Expected: a version at or after v0.17.1-0.20250502112255-56600883e0e9