High, CVSS 8.9crates.ioPublished
Plonky3 MultiField32Challenger: transcript malleability and challenge entropy loss
CVE-2026-46654 · GHSA-vj64-rjf3-w3v7
- Affected
- crates.io p3-challenger < 0.4.3; >= 0.5.0, < 0.5.3
- Fixed in
- 0.4.30.5.3· Vendor fix available
- Issue
- Impact - Key: challenger/src/multifieldchallenger.rs | MultiField32Challenger::duplexing | transcriptmalleability - Affected files: challenger/src/multifieldchallenger.rs, field/src/helpers.rs - Violated invariant: The Fiat-Shamir sponge must bind challenges to the exact sequence of observed field elements. Specifically: (1) absorption must be injective — distinct observation streams must produce distinct sponge states, (2) squeezing must be injective — distinct PF rate cells must yield distinct F challenge sequences, and (3) all bits of each absorbed PF element must influence the sponge state. - Exploit scenario: An attacker controlling prover-side observations can craft distinct transcripts that produce identical challenges, breaking the binding property of Fiat-Shamir. Three independent attack vectors exist: 1. Partial-chunk aliasing (absorb): duplexing() packs inputbuffer.chunks(numfelms) via reduce32 (base 2^32) with no length marker and no zeroing of unused rate slots.…
Recommended action: Upgrade to 0.5.3 or 0.4.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.