CVE-2026-46654
NoneCVSS
—
EPSS
0.1%
Published
Jun 10, 2026
CISA due date
—
The record
Plonky3 is a toolkit for polynomial IOPs (PIOPs). Prior to versions 0.4.3 and 0.5.3, an attacker controlling prover-side observations can craft distinct transcripts that produce identical challenges, breaking the binding property of Fiat-Shamir. This issue has been patched in versions 0.4.3 and 0.5.3.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | p3-challenger | 0 | 0.4.3 |
| crates.io | p3-challenger | 0.5.0 | 0.5.3 |
Related vulnerabilities
- GHSA-vj64-rjf3-w3v7 Plonky3 MultiField32Challenger: transcript malleability and challenge entropy loss Same vulnerability
- CVE-2026-102682 Pipecat is an open-source Python framework for building real-time voice and multimodal… CWE-345
- CVE-2026-104850 MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and… CWE-345
- CVE-2026-102275 PyJWT is a Python implementation of JSON Web Token standards. CWE-345
- CVE-2026-102267 PyJWT is a Python implementation of JSON Web Token standards. CWE-345
- CVE-2026-19941 An inapplicable NSEC record may be accepted by a `named` resolver as proof that no… CWE-345
- CVE-2026-77955 In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD… CWE-345
- CVE-2026-89251 AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ad… CWE-345