CVE-2026-40323
High · 7.5CVSS
7.5
EPSS
0.2%
Published
Apr 18, 2026
CISA due date
—
The record
SP1 is a zero‑knowledge virtual machine that proves the correct execution of programs compiled for the RISC-V architecture. In versions 6.0.0 through 6.0.2, a soundness vulnerability in the SP1 V6 recursive shard verifier allows a malicious prover to construct a recursive proof from a shard proof that the native verifier would reject. Version 6.1.0 fixes the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | sp1_prover | 6.0.0 | 6.1.0 |
| crates.io | sp1_recursion_circuit | 6.0.0 | 6.1.0 |
| crates.io | sp1_sdk | 6.0.0 | 6.1.0 |
Related vulnerabilities
- GHSA-63x8-x938-vx33 SP1 V6 Recursion Circuit Row-Count Binding Gap Same vulnerability
- CVE-2026-102682 Pipecat is an open-source Python framework for building real-time voice and multimodal… CWE-345
- CVE-2026-104850 MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and… CWE-345
- CVE-2026-102275 PyJWT is a Python implementation of JSON Web Token standards. CWE-345
- CVE-2026-102267 PyJWT is a Python implementation of JSON Web Token standards. CWE-345
- CVE-2026-19941 An inapplicable NSEC record may be accepted by a `named` resolver as proof that no… CWE-345
- CVE-2026-77955 In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD… CWE-345
- CVE-2026-89251 AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ad… CWE-345