Signature Malleability Vulnerability in gnark Framework by Consensys

CVE-2025-57801

What is CVE-2025-57801?

The gnark framework, developed by Consensys, has been found to contain a signature malleability vulnerability in versions prior to 0.14.0. This vulnerability arises from the Verify function not properly asserting the conditions on the S value of a signature, which should be within the specified range. As a result, it permits the existence of multiple valid signatures for the same message, potentially enabling malicious actors to exploit this flaw for double spending in systems that depend on unique transaction identifiers. This issue has been rectified in version 0.14.0, which reinforces the necessary constraints to prevent such vulnerabilities.

References