{"id":"GO-2025-4087","summary":"Unchecked memory allocation during vector deserialization in github.com/consensys/gnark-crypto","details":"Unchecked memory allocation during vector deserialization in github.com/consensys/gnark-crypto","aliases":["GHSA-fj2x-735w-74vq"],"modified":"2026-02-04T03:47:39.892431Z","published":"2025-11-05T18:41:07Z","related":["CGA-q3pc-g2qx-vmhf"],"database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2025-4087"},"references":[{"type":"ADVISORY","url":"https://github.com/Consensys/gnark-crypto/security/advisories/GHSA-fj2x-735w-74vq"},{"type":"WEB","url":"https://github.com/Consensys/gnark-crypto/commit/2e7bf9190a0aac896eeec3876c87c77a35661be7"},{"type":"WEB","url":"https://github.com/Consensys/gnark-crypto/pull/759"},{"type":"FIX","url":"https://github.com/Consensys/gnark-crypto/commit/2e7bf9190a0aac896eeec3876c87c77a35661be7"}],"affected":[{"package":{"name":"github.com/consensys/gnark-crypto","ecosystem":"Go","purl":"pkg:golang/github.com/consensys/gnark-crypto"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.9.1"},{"fixed":"0.18.1"},{"introduced":"0.19.0"},{"fixed":"0.19.2"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/consensys/gnark-crypto/ecc/secp256k1/fr","symbols":["Vector.AsyncReadFrom","Vector.ReadFrom","Vector.UnmarshalBinary"]},{"symbols":["Vector.AsyncReadFrom","Vector.ReadFrom","Vector.UnmarshalBinary"],"path":"github.com/consensys/gnark-crypto/ecc/bw6-633/fp"},{"path":"github.com/consensys/gnark-crypto/ecc/bls12-377/fp","symbols":["Vector.AsyncReadFrom","Vector.ReadFrom","Vector.UnmarshalBinary"]},{"path":"github.com/consensys/gnark-crypto/ecc/bls12-381/fp","symbols":["Vector.AsyncReadFrom","Vector.ReadFrom","Vector.UnmarshalBinary"]},{"path":"github.com/consensys/gnark-crypto/ecc/grumpkin/fp","symbols":["Vector.AsyncReadFrom","Vector.ReadFrom","Vector.UnmarshalBinary"]},{"path":"github.com/consensys/gnark-crypto/ecc/bw6-633/fr","symbols":["Vector.AsyncReadFrom","Vector.ReadFrom","Vector.UnmarshalBinary"]},{"symbols":["Vector.AsyncReadFrom","Vector.ReadFrom","Vector.UnmarshalBinary"],"path":"github.com/consensys/gnark-crypto/ecc/bls12-377/fr"},{"path":"github.com/consensys/gnark-crypto/ecc/bls24-315/fr","symbols":["Vector.AsyncReadFrom","Vector.ReadFrom","Vector.UnmarshalBinary"]},{"path":"github.com/consensys/gnark-crypto/field/babybear","symbols":["Vector.AsyncReadFrom","Vector.ReadFrom","Vector.UnmarshalBinary"]},{"path":"github.com/consensys/gnark-crypto/ecc/stark-curve/fr","symbols":["Vector.AsyncReadFrom","Vector.ReadFrom","Vector.UnmarshalBinary"]},{"path":"github.com/consensys/gnark-crypto/ecc/grumpkin/fr","symbols":["Vector.AsyncReadFrom","Vector.ReadFrom","Vector.UnmarshalBinary"]},{"path":"github.com/consensys/gnark-crypto/ecc/bn254/fp","symbols":["Vector.AsyncReadFrom","Vector.ReadFrom","Vector.UnmarshalBinary"]},{"path":"github.com/consensys/gnark-crypto/ecc/bls24-317/fr","symbols":["Vector.AsyncReadFrom","Vector.ReadFrom","Vector.UnmarshalBinary"]},{"path":"github.com/consensys/gnark-crypto/field/goldilocks","symbols":["Vector.AsyncReadFrom","Vector.ReadFrom","Vector.UnmarshalBinary"]},{"path":"github.com/consensys/gnark-crypto/ecc/bn254/fr","symbols":["Vector.AsyncReadFrom","Vector.ReadFrom","Vector.UnmarshalBinary"]},{"path":"github.com/consensys/gnark-crypto/ecc/bls12-381/fr","symbols":["Vector.AsyncReadFrom","Vector.ReadFrom","Vector.UnmarshalBinary"]},{"path":"github.com/consensys/gnark-crypto/ecc/secp256k1/fp","symbols":["Vector.AsyncReadFrom","Vector.ReadFrom","Vector.UnmarshalBinary"]},{"path":"github.com/consensys/gnark-crypto/field/koalabear","symbols":["Vector.AsyncReadFrom","Vector.ReadFrom","Vector.UnmarshalBinary"]},{"path":"github.com/consensys/gnark-crypto/ecc/bls24-315/fp","symbols":["Vector.AsyncReadFrom","Vector.ReadFrom","Vector.UnmarshalBinary"]},{"path":"github.com/consensys/gnark-crypto/ecc/stark-curve/fp","symbols":["Vector.AsyncReadFrom","Vector.ReadFrom","Vector.UnmarshalBinary"]},{"path":"github.com/consensys/gnark-crypto/ecc/bw6-761/fp","symbols":["Vector.AsyncReadFrom","Vector.ReadFrom","Vector.UnmarshalBinary"]},{"path":"github.com/consensys/gnark-crypto/ecc/bls24-317/fp","symbols":["Vector.AsyncReadFrom","Vector.ReadFrom","Vector.UnmarshalBinary"]},{"path":"github.com/consensys/gnark-crypto/ecc/bw6-761/fr","symbols":["Vector.AsyncReadFrom","Vector.ReadFrom","Vector.UnmarshalBinary"]}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2025-4087.json"}}],"schema_version":"1.7.3"}