CVE-2025-24802: Plonky2 Soundness Issue With Plonky2 Look Vulnerability

HIGH
Advisory Identifier: GHSA-hj49-h7fq-px5h
Share
CVSS 8.6
CWE-1240
Published
Advisory Summary

CVE-2025-24802 is a HIGH (CVSS 8.6) soundness issue with plonky2 look vulnerability (CWE-1240: Use of a Cryptographic Primitive with a Risky Implementation) affecting Plonky2 libraries in the crates.io ecosystem. The issue involves soundness issue with plonky2 look up tables. Remediation is available by upgrading affected packages to version 1.0.1.

CVE-2025-24802 at a Glance

CVE Identifier CVE-2025-24802
GHSA Identifier GHSA-hj49-h7fq-px5h
Severity HIGH
CVSS v3.1 Base Score 8.6
CWE Classification CWE-1240: Use of a Cryptographic Primitive with a Risky Implementation
Affected Product Plonky2
Package Ecosystem crates.io
Published Date
Last Updated

Security Impact

CVSS: 8.6

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Changed (S:C)
Confidentiality None (C:N)
Integrity High (I:H)
Availability None (A:N)

How to Fix CVE-2025-24802

To remediate this vulnerability, upgrade all affected Plonky2 dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

plonky2 fixed: 1.0.1 
Upgrade plonky2 to 1.0.1
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for plonky2

How to Check if You Are Affected

To determine whether your application is affected by CVE-2025-24802, inspect your project dependencies for Plonky2:

inspect dependencies for plonky2

Analyze the terminal output to locate any version of Plonky2 in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.0.1), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-1240: Use of a Cryptographic Primitive with a Risky Implementation, where to fulfill the need for a cryptographic primitive, the product implements a cryptographic algorithm using a non-standard, unproven, or disallowed/non-compliant cryptographic implementation. In Plonky2, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact Lookup tables, whose length is not divisible by `26 = floor(num_routed_wires / 3)` always include the `0 -> 0` input-output pair. Thus a malicious prover can always prove that `f(0) = 0` for any lookup table f (unless its length happens to be divisible by 26). The cause of problem is that the `LookupTableGate`-s are [padded with zeros](https://github.com/0xPolygonZero/plonky2/blob/main/plonky2/src/plonk/prover.rs#L97). The fix is done by padding with an existing table pair, similarly to `LookupGate`. A workaround from the user side is to extend the table (by repeating some entries) so that its length becomes divisible by 26. Fortunately, the seemingly most common use case, namely, hash functions with table-based sbox-es, are not vulnerable: * both Monolith's and Tip5/Tip4's s-box tables already map 0 to 0; * more generally, forcing several (0,0) pairs inside such a hash function appears to be a too strong restriction to find an otherwise valid trace. A malicious prover exploiting this could cheat a circuit which statement is the following: - output `x + f(x)` for some private input `x`, where `f(x) := 100 - x` is implemented by a lookup table. A malicious prover would be able to convince an honest verifier that they know an `0 <= x < 64` such that `x + (100 - x) = 0`. ### Patches Yes, upgrade to v1.0.1 ### Workarounds No ### References

CVE-2025-24802 Affected Plonky2 Versions

1 component(s)
Fixed Versions:
1.0.1
Product / Package Ecosystem Affected Versions Fixed Version
plonky2
 crates.io
≥ 1.0.0
< 1.0.1
All 1 versions
1.0.0
1.0.1

References

GitHub Advisory / Wiki ADVISORY
https://github.com/0xPolygonZero/plonky2/security/advisories/GHSA-hj49-h7fq-px5h
NVD — CVE-2025-24802 NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-24802
Security Fix Commit FIX COMMIT
https://github.com/0xPolygonZero/plonky2/commit/091047f7f10cae082716f3738ad59a583835f7b6
Plonky2 Source Repository REPOSITORY
https://github.com/0xPolygonZero/plonky2
Plonky2 Source Repository REPOSITORY
https://github.com/0xPolygonZero/plonky2/blob/main/plonky2/src/plonk/prover.rs#L97

Frequently Asked Questions

What is CVE-2025-24802?
CVE-2025-24802 is a security vulnerability in Plonky2 involving Soundness issue with Plonky2 look up tables under CWE-1240: Use of a Cryptographic Primitive with a Risky Implementation.
Which Plonky2 versions are affected?
Affected versions include releases prior to 1.0.1 across affected packages: plonky2.
What version fixes CVE-2025-24802?
Upgrading to 1.0.1 (or the latest patched release for your respective branch) resolves the vulnerability.
Is plonky2 affected?
Yes, plonky2 is affected in releases prior to 1.0.1. Upgrade your dependency to 1.0.1 or later.
What is the CVSS score of CVE-2025-24802?
CVE-2025-24802 has a CVSS v3.1 base score of 8.6 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N.
What CWE is associated with CVE-2025-24802?
CVE-2025-24802 is classified under CWE-1240: Use of a Cryptographic Primitive with a Risky Implementation (To fulfill the need for a cryptographic primitive, the product implements a cryptographic algorithm using a non-standard, unproven, or disallowed/non-compliant cryptographic implementation.).
How can I check crates.io dependencies for CVE-2025-24802?
Run the dependency tree command: 'inspect dependencies for plonky2'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-hj49-h7fq-px5h",
  "modified" : "2025-01-30T21:36:51Z",
  "published" : "2025-01-30T19:28:51Z",
  "aliases" : [ "CVE-2025-24802" ],
  "summary" : "Soundness issue with Plonky2 look up tables",
  "details" : "### Impact\nLookup tables, whose length is not divisible by `26 = floor(num_routed_wires / 3)` always include the `0 -> 0` input-output pair. Thus a malicious prover can always prove that `f(0) = 0` for any lookup table f (unless its length happens to be divisible by 26).\n\nThe cause of problem is that the `LookupTableGate`-s are [padded with zeros](https://github.com/0xPolygonZero/plonky2/blob/main/plonky2/src/plonk/prover.rs#L97).\n\nThe fix is done by padding with an existing table pair, similarly to `LookupGate`.\n\nA workaround from the user side is to extend the table (by repeating some entries) so that its length becomes divisible by 26.\n\nFortunately, the seemingly most common use case, namely, hash functions with table-based sbox-es, are not vulnerable:\n\n* both Monolith's and Tip5/Tip4's s-box tables already map 0 to 0;\n* more generally, forcing several (0,0) pairs inside such a hash function appears to be a too strong restriction to find an otherwise valid trace.\n\nA malicious prover exploiting this could cheat a circuit which statement is the following:\n- output `x + f(x)` for some private input `x`, where `f(x) := 100 - x` is implemented by a lookup table.\n\nA malicious prover would be able to convince an honest verifier that they know an `0 <= x < 64` such that `x + (100 - x) = 0`.\n\n### Patches\nYes, upgrade to v1.0.1\n\n### Workarounds\nNo\n\n### References\n\n",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "crates.io",
      "name" : "plonky2"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.0.0"
      }, {
        "fixed" : "1.0.1"
      } ]
    } ],
    "versions" : [ "1.0.0" ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/0xPolygonZero/plonky2/security/advisories/GHSA-hj49-h7fq-px5h"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-24802"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/0xPolygonZero/plonky2/commit/091047f7f10cae082716f3738ad59a583835f7b6"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/0xPolygonZero/plonky2"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/0xPolygonZero/plonky2/blob/main/plonky2/src/plonk/prover.rs#L97"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-1240" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-01-30T19:28:51Z",
    "nvd_published_at" : "2025-01-30T20:15:51Z"
  }
}