A gnark vulnerability rated 7.5 enables invalid proofs; version 0.16.5 fixes it
Key Facts
Consensys published a security advisory on November 9, 2026, classifying the issue as High and assigning it a CVSS score of 7.5 out of 10. The flaw affects scalar multiplication in the BLS12-381 G1 and BW6-761 G1 curves in the gnark library. The advisory said a malicious prover could make the operation ScalarMul(P, s) return a point that does not equal the expected mathematical result [s]P. The vulnerability reporter demonstrated full forgeries of Groth16 proofs on both curves, putting the integrity of circuits that rely on the affected components at the center of the issue. The advisory identified a network attack vector, with low complexity and no privileges required. The project released gnark v0.16.5 the same day and urged all users to upgrade to it.
The affected scope extends to versions earlier than 0.16.5, while the fix is included in v0.16.5 and later. The project identified paths through which the flaw could be reached via the ScalarMul, ScalarMulBase, JointScalarMul and MultiScalarMul scalar multiplication interfaces, as well as the G1MSM component associated with EIP-2537. It said KZG and PLONK circuits, and Groth16 setups on the two curves in question, could reach the flaw, along with other scalar multiplication interfaces. In the BLS12-381 path, the attack runs through the G1MSM component, while on BW6-761 it runs through the public ScalarMul interface. This means the practical review should cover circuits that use these specific components, rather than assuming that every application using gnark is affected in the same way.
The advisory attributed the flaw to two independent causes. The first was an exceptional addition in the classical GLV loop; the second was the absence of a check that the input point belongs to the correct subgroup. The project explained that the loop fix adds a small, fixed-order offset point to the accumulator, so that no step in the loop falls into the exceptional case for any decomposition. The fix also requires checking that the input point belongs to the subgroup. According to the advisory, upgrading is the only workaround for the first issue; for the second, it recommends checking that each input point belongs to the subgroup before performing scalar multiplication.
Version v0.16.5 addresses more than the main flaw, including other integrity fixes in the BLS12-381 G2 multi-scalar multiplication component, the SHA-3 FixedLengthSum function and EdDSA public-key verification. These fixes affect the constraint systems built by circuits, so upgrading may require operational steps beyond updating the library. The project said users will likely need to recompile circuits, perform a new setup and redeploy on-chain verifiers. For Groth16 users specifically, the release called for a new setup for each circuit, followed by redeployment of the on-chain verifiers. These steps link the code fix to the need to update the verification setups used by affected circuits.
gnark is an open-source Go library that provides a high-level interface for designing zk-SNARK circuits. The EIP-2537 standard defines operations on the BLS12-381 curve, including multi-scalar multiplication operations that can be used to aggregate public keys or signatures. According to the Ethereum roadmap, this curve is used in the consensus layer, and its on-chain operations also serve applications including staking and restaking pools, light clients, bridges and zero-knowledge proofs. In this context, the disclosure concerns a flaw in specific components of a circuit-building library, and its impact may extend to circuits that use those components. The advisory published on October 7 was separate: it concerned the absence of an on-curve check in the fake-GLV path, affected versions earlier than v0.16.4 and described the possibility of forging ECDSA signatures on specific curves; it was fixed in v0.16.4.