GitHub Advisoryadvisory · crates.io

GHSA-vjf8-9fx6-mv6x Triton VM Soundness Vulnerability due to Missing Constraint

MEDIUM Published 2026-08-18 Modified 2026-08-18 Official page ↗
Ecosystem
crates.io
Packages
triton-vm
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-345
Reviewed
2026-08-18

Affected packages

• crates.io triton-vm: >= 0.42.0-alpha.4, < 4.0.0 → fixed in 4.0.0

Description

The instruction `sponge_absorb_mem` Triton VM fails to verify that hashed values come from the claimed memory location. Malicious provers can substitute arbitrary data instead of actual memory contents. Any application using instruction `sponge_absorb_mem` to hash memory data can be given a proof for a forged hash that doesn't correspond to the actual memory. This breaks the security of memory-based commitments. The flaw was corrected in commits `17c7ba0a` and `ef9d9e72` by including the appropriate constraints.

Related

Weakness · CWE (1)

  • CWE-345 Insufficient Verification of Data Authenticity weakness

References