CVE-2026-46654 — Plonky3 MultiField32Challenger: transcript malleability and challenge entropy loss

CVE-2026-46654

Plonky3 MultiField32Challenger: transcript malleability and challenge entropy loss PUBLISHED

Description (CNA)

Plonky3 is a toolkit for polynomial IOPs (PIOPs). Prior to versions 0.4.3 and 0.5.3, an attacker controlling prover-side observations can craft distinct transcripts that produce identical challenges, breaking the binding property of Fiat-Shamir. This issue has been patched in versions 0.4.3 and 0.5.3.

Affected (CNA)

Vendor / product	Versions
Plonky3 / Plonky3	affected < 0.4.3; affected >= 0.5.0, < 0.5.3

CWE

CWE-1240, CWE-345

References

https://github.com/Plonky3/Plonky3/security/advisories/GHSA-vj64-rjf3-w3v7

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.