CVSS 4.0
8.9 highCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:NCVE-2026-46654
High (8.9). EPSS 0.1% chance of exploitation in the next 30 days. Fixed in p3-challenger 0.4.3, 0.5.3.
Plonky3 is a toolkit for polynomial IOPs (PIOPs). Prior to versions 0.4.3 and 0.5.3, an attacker controlling prover-side observations can craft distinct transcripts that produce identical challenges, breaking the binding property of Fiat-Shamir. This issue has been patched in versions 0.4.3 and 0.5.3.
Severity
- EPSS
- 0.1% chance of exploitation in the next 30 days; higher than 1% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-345, CWE-1240
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-vj64-rjf3-w3v7 | crates.io | p3-challenger | <0.4.3 | 0.4.3 |
| GHSA-vj64-rjf3-w3v7 | crates.io | p3-challenger | >=0.5.0 <0.5.3 | 0.5.3 |