AIKIDO-2026-238018
risc0-zkp is vulnerable to Denial of Service (DoS)
53
Medium Risk
This Affects:
risc0-zkpTL;DR
The proof verification code in risc0-zkp reads fields, digests, and the po2 parameter out of the seal without fully validating their length or contents. A crafted or truncated seal can trigger out-of-bounds index operations, failed assertions, and invalid field-element conversions, causing the verifier to panic instead of returning a verification error. An attacker who supplies a malformed proof to a verifier can abort verification and crash the hosting process or thread. The fix converts the affected IOP-read, Merkle, and hash paths to fallible APIs and validates digests and po2 before use.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application verifies proofs or seals originating from untrusted sources.
Background info
risc0-zkp is vulnerable to Denial of Service (DoS) in versions 0.11.0 - 3.0.4.
How to fix this
Upgrade the risc0-zkp library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.